Wildcard *.eth.limo turned every ENS site behind that gateway into a phishing surface the moment someone impersonating the team got past EasyDNS support — vitalik.eth, whatever you typed in. DNSSEC blocked validating resolvers from serving the bogus records, but stub resolvers at most consumer ISPs don't validate, so coverage was uneven and a chunk of users still hit the malicious IPs. ENS records on-chain stay decentralized; the HTTPS bridge sits one social-engineered ticket away from owning every visitor who didn't pin the IPFS hash locally. Aerodrome's frontend hit on Base last week ran the same playbook for ~$1M, Cream before that — registrar accounts are the soft underbelly the audited contracts can't protect.

Top comment by @Benthic