trivy.dev appears parked since Nov 3 21:34 UTC: get.trivy.dev is NXDOMAIN, breaking install.sh and setup-trivy

[mitchnielsen]

Description

trivy.dev appears to have been parked. The registry's RDAP record shows last changed at 2026-11-03 21:34:00 UTC, with nameservers ns75 and ns76.domaincontrol.com. Since then, get.trivy.dev has returned NXDOMAIN on most public resolvers I tried, and the delegated nameserver has no record for it.

contrib/install.sh downloads the release tarball from this host, so installs fail. That includes aquasecurity/setup-trivy, and aquasecurity/trivy-action through it.

Evidence as of about 23:37 UTC on Nov 3:

• get.trivy.dev returns NXDOMAIN from 8.8.8.8, 1.1.1.1, and 208.67.222.222, and from ns75.domaincontrol.com. 9.9.9.9 gave mixed answers, probably from its cache.
• bristol.ns.cloudflare.com still returns 104.26.2.26, 104.26.3.26, and 172.67.72.165, so the record looks like it wasn't carried over.
• Public resolvers mostly return 13.248.213.45 and 76.223.67.189 for trivy.dev. The new IP fails TLS for trivy.dev, and over HTTP it redirects to /lander, which looks like a parking page.
• RDAP shows GoDaddy as registrar, status auto renew period, and expiry 2027-10-29.

Machines with a cached DNS answer still reach the site, so this can look fine locally.

Desired Behavior

get.trivy.dev resolves on public DNS, and contrib/install.sh, setup-trivy, and trivy-action install Trivy normally.

If a tarball download fails, install.sh should print an error that names the URL. It could also fall back to GitHub releases, which still serve the same tarball.

Actual Behavior

trivy-action jobs fail while installing Trivy, before any scan runs:

aquasecurity/trivy info checking GitHub for tag 'v0.70.0'
aquasecurity/trivy info found version: 0.70.0 for v0.70.0/Linux/64bit
##[error]Process completed with exit code 6.

Exit code 6 matches curl's "could not resolve host". Our failures began around 21:34 UTC, first intermittently and then on every run.

The installer calls curl with -s and runs under set -e, so nothing in the log points to DNS or to get.trivy.dev. The last visible line mentions GitHub, which makes this look like a GitHub problem.

We're using trivy-action at ed142fd0673e97e23eac54620cfb913e5ce36c25 with setup-trivy v0.2.6 and Trivy v0.70.0.

Reproduction Steps

dig @8.8.8.8 get.trivy.dev +short
dig @ns75.domaincontrol.com get.trivy.dev +short
dig @bristol.ns.cloudflare.com get.trivy.dev +short


(no results)

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

n/a

Operating System

MacOS, Linux

Version

0.70.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[zanaca]

~ dig get.trivy.dev

; <<>> DiG 9.10.6 <<>> get.trivy.dev
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43567
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;get.trivy.dev.			IN	A

;; AUTHORITY SECTION:
trivy.dev.		600	IN	SOA	ns75.domaincontrol.com. dns.jomax.net. 2026110301 28800 7200 604800 600

;; Query time: 452 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Nov 03 20:38:28 -03 2026
;; MSG SIZE  rcvd: 113

[ajishfrancis]

Trivy extension in the Azure DevOps pipeline is failing

Starting Trivy task...
Requested Trivy version to install: latest
Resolved version: v0.76.1
Downloading: https://get.trivy.dev/trivy?client=azure-pipeline&version=0.76.1&os=Linux&arch=64bit&type=tar.gz
##[error]getaddrinfo ENOTFOUND get.trivy.dev

[mjpraxis]

Looks like someone forgot to renew the domain trivy.dev 😢

We've renewed the trivy.dev domain. Thanks for reporting the issue and for the detailed DNS checks.

[thiagoloureiro]

this was pretty dangerous, someone malicious could create a clone of trivy and put a malicious tar.gz there to fetch your creds...