I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain

    • Elvith Ma'for@feddit.org
      1·
      6 months ago

      Checks own servers…

      Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

      Yeah, I’d like to see that…

        • Elvith Ma'for@feddit.org
          1·
          6 months ago

          Yeah, but now you’re talking about communicating with web.archive.org and not nonesense.reputable-bank.com as in the original post. In this case you’re not even trying to hide the fact, that you aren’t affiliated with reputable-bank.com and we’re back to square one and you could also just use reputable-bank.com.some.malicious-phishing.website to host your page.

          Btw: all modern browsers will warn you when you access a non-encrypted website - some immediately, some only when you try to enter data into a login form.