My domain got abused on GitHub Pages

A developer discovered their domain was being abused on GitHub Pages when Google Search Console alerted them to a subdomain (kafka.immersivepoints.com) they didn't own being hosted on their domain. The vulnerability occurred because they had set up a wildcard DNS record forwarding all subdomains to GitHub, allowing any GitHub user to host content on their domain by simply creating a CNAME file in their repository. The author argues GitHub should implement better domain verification mechanisms to prevent such abuse, as this is a known vulnerability that could be exploited for scams.