Add reference to phishing usage

content/post/ngrok-dns.adoc

@@ -201,7 +201,7 @@ In the logs that NextDNS provides I can see:
 
 image::/images/2024/05/nextdns01.webp[NextDNS screenshot showing DNS resolution for ngrok blocked by Threat Intelligence Feeds blocklist]
 
-As well as blocking crap like ads and tracking domains, NextDNS also blocks DNS resolutions for sites that are deemed nefarious. It looks like ngrok ended up on one of https://www.cloudflare.com/learning/security/glossary/threat-intelligence-feed/[these lists] - probably because ngrok could be used to serve phishing websites etc. After adding `*.ngrok.io` to my NextDNS Allowlist I got this:
+As well as blocking crap like ads and tracking domains, NextDNS also blocks DNS resolutions for sites that are deemed nefarious. It looks like ngrok ended up on one of https://www.cloudflare.com/learning/security/glossary/threat-intelligence-feed/[these lists] - probably because ngrok is sometimes abused to https://cyble.com/blog/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/[serve phishing websites] etc. After adding `*.ngrok.io` to my NextDNS Allowlist I got this:
 
 [source,bash]
 ----
@@ -312,4 +312,4 @@ L YKIg/Y0nryoSZq/wUkwweFvcrr0UrMeH0f6iR5rfaxrrjPcL7E8UrNRU 9aHjHg== from server
 A 18.158.249.75 from server 205.251.192.146 in 19 ms.
 ----
 
-I'd love to hear from you if you can explain what's happening with this :)
+I'd love to hear from you if you can explain what's happening with this :)