Ghrc.io appears to be malicious • Hacker News Board

Re: Ghrc.io appears to be malicious

#71

Post by TheDong » Mon, Aug 25, 2025, 2:56 PM UTC

antihero wrote: post #63

TheDong wrote: post #38

Earlier quoted context omitted.

Good luck with that. People over in this github-actions issue are struggling to get github's attention for a 1-line fix to stop hanging jobs forever https://github.com/actions/runner/issues/3792#issuecomment-3... That bug is incredibly dumb and obvious. There's been a PR to fix it for over a year with no attention. I bet there's not a dedicated "github domain names" team, it's probably part of some overworked platfor…

Apparently fixed five days ago: https://github.com/actions/runner/pull/3157 But yes a joke of a situation.

"fixed" by still busylooping at 100% of a core in order to sleep.

I don't count that as totally fixed.

Re: Ghrc.io appears to be malicious

#72

Post by lacoolj » Mon, Aug 25, 2025, 5:54 PM UTC

looks like it was either taken down or turned off. trying to run the same curl commands now just sits empty trying to access the IP

curl -i -v https://ghrc.io/v2/ * Trying 128.199.6.40:443...

Re: Ghrc.io appears to be malicious

#73

Post by spixy » Mon, Aug 25, 2025, 6:54 PM UTC

echelon wrote: post #11

nicce wrote: post #9

GitHub Container registry does not even support fine-grained tokens, instead it uses classic ones [1], which makes this even more dangerous. [1] https://docs.github.com/en/packages/working-with-a-github-pa... Edit: most relevant issues? https://github.com/orgs/community/discussions/38467 https://github.com/github/roadmap/issues/558

Someone near a computer that is feeling generous should buy up all the typo'd domain names and hand them over to Microsoft. Microsoft should rename the registry. This is a horrible name. I know I've typo'd it before.

* GitHub Inc.

Re: Ghrc.io appears to be malicious

#74

Post by TZubiri » Mon, Aug 25, 2025, 7:49 PM UTC

bragr wrote: post #29

TZubiri wrote: post #23

Reminder not to use goofy TLDs, being cute is not worth it when compared to security. There's no guarantees that the process for taking down a malicious domain will be as smooth as a .com. I'd rather deal with US verisign rather than the British Indian Ocean territory or colombia or anguila

The .io TLD is administered by Afilias which is an American corporation.

Confirmed:

>$dig io >$dig a0.nic.io >$whois 65.22.160.17

OrgName: Afilias, Inc. OrgId: AFILI-2 Address: 10500 NE 8th Street City: Bellevue StateProv: WA PostalCode: 98004 Country: US

Re: Ghrc.io appears to be malicious

#75

Post by usr1106 » Tue, Aug 26, 2025, 4:26 AM UTC

_def wrote: post #41

usr1106 wrote: post #34

One reason why you should never think or say ghcr, but always github container register, even if that is longer. You should have enough time for not getting trapped. Root cause a stupid FLA of course. For several months I thought it means Google whatever register.

I couldn't find anything useful - what is a FLA?

Of course I made it up, I assumed TLA is known as three letter acronym. Now ghcr has four of them...

Re: Ghrc.io appears to be malicious

#76

Post by airtonix » Tue, Aug 26, 2025, 8:08 AM UTC

koakuma-chan wrote: post #65

nottorp wrote: post #60

Earlier quoted context omitted.

Isn't that an official MS service for github?

Yeah, and what I'm saying is that it may be hard to get people within your org to do something for you.

[dead]

Re: Ghrc.io appears to be malicious

#77

Post by h3x0ne » Wed, Aug 27, 2025, 1:06 PM UTC

gruez wrote: post #27

whois says it's registered by dynadot, so it's probably worth contacting their abuse email: abuse@dynadot.com

already happened :)

Re: Ghrc.io appears to be malicious

#78

Post by h3x0ne » Wed, Aug 27, 2025, 1:08 PM UTC

lacoolj wrote: post #72

looks like it was either taken down or turned off. trying to run the same curl commands now just sits empty trying to access the IP curl -i -v https://ghrc.io/v2/ * Trying 128.199.6.40:443...

No seems back again