Bender on Phishers are hijacking legitimate cloud infrastructure

Comment on Phishers are hijacking legitimate cloud infrastructure

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain.

    local-zone:     "workers.dev." always_null
    local-zone:     "pages.dev." always_null
    local-zone:     "vercel.app." always_null
    local-zone:     "netlify.app." always_null
    local-zone:     "dweb.link." always_null
    local-zone:     "ipfs.io." always_null

    dig +short test.vercel.app
    0.0.0.0

embedding-shape 1mo

drweb.link."

Considering you have ipfs.io on that list, I wonder if this is a typo for dweb.link actually?

Bender 1mo

That is a typo, I will fix it. Thankyou!

ronsor 1mo

If you block github.io, you may as well stop using half this site.

Bender 1mo

Looking back through all my DNS query logs for 2026 my biggest dependency on github.io is a rule-set in uBlock.

       1358 ublockorigin.github.io
        446 curbengh.github.io
         24 loathingkernel.github.io
         22 ytdl-org.github.io
         16 moomoohk.github.io
          6 profanity-im.github.io
          5 gtfobins.github.io
          3 simonw.github.io

psd1 1mo

You think? I don't believe i have seen a single submission here using the github.io domain.

It's possible some submissions are hosted there on a user's domain and heavily themed, but i suspect it's just not a host for many submissions. I'm not verifying that; of course i may be wrong.

Comments