GitHub phishing & impersonation
Tech & Cloudgithub.com
18
Sites impersonating it
11
New in the last 30 days
0
Campaigns
2026-11-11
Last detected
2026-08-182026-11-15
Where these sites are hosted
23 on free hosting platforms, 3 on 3 registered domains
workers.dev · 21onrender.com · 1pages.dev · 1.com · 2.cfd · 1
Official domains
github.com
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Sites impersonating GitHub
26 of 26 sites · newest first · repeat scans of a site are grouped
Showing all sites, including 8 lower-risk copies that neither our rule engine nor our AI analysis rates high risk. Hide them
instrumentoguitarra.cfd GitHub · Change is constant. GitHub keeps you ahead. · GitHub · GitHub2026-11-11RulesHigh RiskAIHigh Risk“GitHub” in the page titleAI analysis
RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesLow RiskAIHigh RiskGitHub logo on a non-official hostAI analysisLogo / favicon
github.whoisthetty. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-11-03RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesHigh RiskAIHigh Risk“GitHub” in the hostnameAI analysis
ghcr.alikhodadadi. com GitHub Actions · CI/CD and automations · Agentic Workflows · Workflows · GitHub2026-10-26RulesLow RiskAIModerate Risklower risk“GitHub” in the page titleAI analysis
RulesHigh RiskAIModerate Risk“GitHub” in the hostnameAI analysis
git-lucky.maydaywei2020. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-24RulesLow RiskAIHigh Risk“GitHub” in the page titleAI analysis
github.sunshixu1994. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-19RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“GitHub” in the hostnameAI analysis
git-hill-8dbd.1309760985. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-17RulesLow RiskAIModerate Risklower risk“GitHub” in the page titleAI analysis
github.459914938. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-17RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
RulesMedium RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“GitHub” in the hostnameAI analysis
github.449378259. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-09RulesMedium RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
github.364515640. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-08RulesMedium RiskAIHigh Risk“GitHub” in the hostnameAI analysis
github.skywalker233. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-08RulesMedium RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
github.gzp18410026550. workers. dev GitHub AI · AI built into every step of your workflow · GitHub2026-10-07RulesMedium RiskAIModerate Risklower risk“GitHub” in the hostnameAI analysis
RulesHigh RiskAIModerate RiskPossible GitHub Phishing on cloud hosting“GitHub” in page or screenshot textScreenshot text
megachangelog.com npm adds preventive account protection for high-impact accounts — GitHub Changelog | megachangelog2026-07-02RulesHigh RiskAILow Risk“GitHub” in the page titlePage text
10 further sites are not listed at all: the GitHub name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).