An unconnected url is pointing at my nodeBB url - Any ideas why?

[omega]

Simple terms, another url (let's cal lit X) is pointing at my nodeBB url and they are getting top result in the SERP, when googling the domain name exactly.

Not sure it's malicious but it's weird, I don't see any redirect, X url has a 301 points back to X url, so self loop. Yet google send X url to my url.

Both Url are using Cloudflare DNS, is there a bug or some weird recycling issue?

The concerning thing here is you could login in under the X Url. I didn't test it but it seems to be the case.

[PitaJ]

You can set up a 404 response from the x url inside your reverse proxy. Pretty sure there's a way to report this kind of abuse to Google.