A developer discovered their domain was being abused by scammers who spun up fake subdomains (e.g., kafka.immersivepoints.com) on GitHub Pages. The root cause was a wildcard DNS record pointing to GitHub's servers — GitHub resolves any subdomain as long as a repository has a matching CNAME file, even from private repos. The author only noticed via Google Search Console alerts. The post explains the subdomain takeover vulnerability, notes existing tools that help attackers find such targets, and suggests GitHub should enforce domain verification more prominently. A post-scriptum notes that GitHub does offer domain verification in account settings, but the feature is easy to miss.
1.8K Impressions