When accessing a spoof URL by hostname (e.g. /unattended/PXELinux?hostname=foo.example.com), the code tries to retrieve an IP and hostname from params, then searches by IP and hostname. If only the hostname was given, it does a find_by_ip(nil), which may return a host (not the right one).