Default site configured for 444 returns 404

[Steinar Bang]

>>>>> Steinar Bang <sb at dod.no>:

One piece of weirdness in the access.log.

These two IP address requests for "/" returns 200.

> 162.216.149.127 - - [23/Aug/2024:00:51:03 +0000] "<server's IPv4 address>" "GET / HTTP/1.1" 200 467 "-" "Expanse, a Palo Alto Networks company, searches across the global IPv4 space multipleer day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo at paloaltonetworks.com"
...
> 185.242.226.70 - - [23/Aug/2024:01:55:09 +0000] "<server's IPv4 address>" "GET / HTTP/1.1" 200 467 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrom324.190 Safari/537.36"

While this one gets the expected 444:

> 199.45.154.128 - - [23/Aug/2024:02:18:44 +0000] "<server's IPv4 address>" "GET / HTTP/1.1" 444 0 "-" "-"

What's the difference between these two I wonder?

Do I have more than one default config? (I think reloading the config
would have failed then?

The one that returns 444 has nothing in the server column, is that significant?