PG could configure the news.ycombinator.com server to return a 301 to any request which has a HOST header that's not news.ycombinator.com - either that or hardc

PG could configure the news.ycombinator.com server to return a 301 to any request which has a HOST header that's not news.ycombinator.com - either that or hardcode the domain name in links. I'm sure that Volida's motives are honest as he stated but this practice - buying a domain name that sounds like something popular and setting the A records to the intended site - has the potential to be used maliciously. All you'd have to do is wait for traffic to grow and then, in time, switch the DNS records to your own site. Of course, the HTTPS pages are going to show certificate problems while your A record is pointing at the original target - but many users will just go ahead and accept bad certificates. How would a legitimate site owner defend against this sort of thing? Would the solution I described in the top paragraph be effective? Has this ever been done maliciously?