In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.Referenceshttp://www.securityfocus.com/bid/102769https://moodle.org/mod/forum/discuss.php?d=364382
