app.nightwither.de

This hostname is currently controlled by a third party because of a dangling CNAME (app.nightwither.de → mrnightwither.github.io, unclaimed, apex domain not verified in GitHub Pages). Any GitHub user can claim it.

Impact demonstrated: a takeover lets an attacker impersonate the brand on a trusted *.nightwither.de host — e.g. a convincing credential-harvest page such as the (non-functional) one below.

E-Mail Passwort

✅ This is a security PoC by an authorized tester. No credentials were transmitted or stored. The form exists only to show how a real phishing page would look on a hijacked brand subdomain.

Reported by: authorized assessment (scope: FULL). Contact the site owner to remediate.

Remediation: verify nightwither.de in GitHub → Settings → Pages and remove or reclaim the app CNAME. See the attached report.