False positive report: console.workbrew.com (and DO CNAME) blocked by AI Threat Detection

[djstarr]

Overview

The NextDNS AI Threat Detection feature is blocking console.workbrew.com and console-gcwy9.ondigitalocean.app. These are the production hostnames for the Workbrew web console, a Mac software-management platform.

Additional Notes

I have worked at Workbrew since November 2025 with NextDNS installed and had no issues. The AI Threat Detection started blocking console.workbrew.com and console-gcwy9.ondigitalocean.app on or around 1 June 2026. Was not blocking on 29 May 2026.

dig console.workbrew.com

; <<>> DiG 9.10.6 <<>> console.workbrew.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5518
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; OPT=15: 00 11 42 6c 6f 63 6b 65 64 20 62 79 20 4e 65 78 74 44 4e 53 3a 20 61 69 2d 74 68 72 65 61 74 2d 64 65 74 65 63 74 69 6f 6e ("..Blocked by NextDNS: ai-threat-detection")
;; QUESTION SECTION:
;console.workbrew.com.		IN	A

;; ANSWER SECTION:
console.workbrew.com.	3600	IN	CNAME	console-gcwy9.ondigitalocean.app.
console-gcwy9.ondigitalocean.app. 300 IN A	0.0.0.0

;; Query time: 66 msec
;; SERVER: 192.0.2.42#53(192.0.2.42)
;; WHEN: Mon Jun 01 10:39:30 CEST 2026
;; MSG SIZE  rcvd: 208

Logs

logs.csv