Both reasons are true. Also, relatedly, "stealing perceived authenticity": if a user sets up "help.github.com" or "about.github.com" or "wwww.github.com" and th

Both reasons are true. Also, relatedly, "stealing perceived authenticity": if a user sets up "help.github.com" or "about.github.com" or "wwww.github.com" and then runs a scam from it, it looks like GitHub is running the scam.