In T33335 it looks like these domains in our DNS config were moved to single-sub names:
; Old double-subdomain aliases (bug 31335)
arbcom.de 600 IN DYNA geoip!text-addrs
arbcom.en 600 IN DYNA geoip!text-addrs
arbcom.fi 600 IN DYNA geoip!text-addrs
arbcom.nl 600 IN DYNA geoip!text-addrs
wg.en 600 IN DYNA geoip!text-addrs
It looks to me like wgCanonicalServer for these moved back in Apr 2014 in https://gerrit.wikimedia.org/r/#/c/121709/ , and the DNS updates were of course even earlier than that. Can we now decom the actual legacy hostnames out of DNS and the apache redirects? I'm trying to audit insecure redirects that we don't have matching certs for at this point, and these seem like easy candidates for removal.