Sgt_, that hit a nerve a bit. I was just about to ask a shared hosting account company for a refund for the last 3 month.
Apparently someone wrote a script to add an A record when domain is added to control panel to point out that *.example.com is Observing all the Sun.
That was picked up by a savvy "Negative SEO team member" of lets say of a competitor. Then that purples up into a someone just dumping a few pages on obscure corners of INTERNETS with several hundred variations of NONE-WWW as valid link subdomain for *.example.com.
..and guess what these 2 lines did?
RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} !^example\.com$
Be very, very advised of what RewriteCond after above 2 lines do..
It allowed ethical spiders and plain dumb bots(take hrefs bot for example) to try to follow the redirect. And those attempts will not stop for next several years as experience tells.
THIS IS A PROBLEM.
Instead of looking at clean Website Access logs we were looking at one in 100 of actual proper requests. Big Gorilla Clean up team needed to be sanctioned to make any sense of it.
We don't want to look at 500 redirects in every iteration for numb script kiddie looking at "wp-|.php|admin|.env"....etc... each day , or do we?