**TL;DR**: This probably was on-topic, it's just a poor example without enough detail.

----

Firefox doesn't report it as "an untrusted site", it reports an "untrusted connection" because the SSL certificate provided, was issued for another domain. Here's the technical explanation Firefox gives (I've subbed the domains involved):

    CCCC.BBBB.net uses an invalid security certificate.
    
    The certificate is only valid for the following names:
      lists.AAAA.net, AAAA.net  
    
    (Error code: ssl_error_bad_cert_domain)

This is a significant distinction to make. An untrusted *site* suggests there is malware, an untrusted certificate suggests admin incompetence (and/or a recent change in domain, plus some incompetence), or it's on a server that also serves `AAAA.net` and `BBBB.net` has no SSL certificate. This is a quirk of sharing a single IP between multiple domains.

The link works fine over http, without encryption.

---

But on the broader question, many of the tools you'd consider wholly illegal, even those which were written *for* illegal purposes (eg DDoSing sites for fun), have legitimate and legal uses too. Usually for the testing of networks, applications, security, etc. Simply put, hackers, security professionals and even just security conscious developers all rely on the same tools and techniques.

In that vein, I'd be against deleting something just because it *could* be used illegally. Almost every element of Ubuntu falls into that gaping chasm, including things you rely on to stay safe.

Even so, you're not wrong to question this answer. If you ever feel uncomfortable about something, raising a flag, or chatting it through on here or Chat is probably the best way forward.

<strike>And here, as Rinz says, it's a completely off-topic answer to the point of looking spammy. It may have just been mis-posted to the wrong open tab. I think we've all done that at some point.</strike>

**HOLD THE PRESS!** The answer is on-topic!

The question is asking how to create a user interface in HTML+CSS. The answer is showing an application that runs locally and provides an interface to be run in a browser window (hence the 127.0.0.1 in the address bar).

This is a slightly convoluted way to manage this and the answer doesn't so much tell you how you'd do this, and there are probably examples that don't involve using a tool suited for DDoSing... But it's a poke in the right direction.