Lvh.me showing parked domain page. expired?

It was always a security issue, now it's just easily confirmed as an active and consistent security issue. Don't just switch to another public alternative if security your concern you're going to have to put up with self administered options (which don't even have to be self hosted just domains you control and can put a wildcard record in).

Found a comment on SO claiming domain was sold [https://stackoverflow.com/questions/51583321/it-is-safe-to-u...]. Switched to vcap.me for now.

There must be some kind of exploit available, with that domain up for grabs and millions of dev environments pointing at it?

Just as a note - it is trivial to register a domain like `foobar.test` and have `foobar.test` and `*.foobar.test` all resolve to 127.0.0.1. And it is under your control.

llvh.me or lacolhost.com