Security Report: github.gzp18410026550.workers.dev - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/24154c12-227f-41a5-8efc-2c7d745da0f9 Domain and IP registration (RDAP)/api/v1/rdap/24154c12-227f-41a5-8efc-2c7d745da0f9How often this domain was scanned/api/v1/domain/stats/github.gzp18410026550.workers.dev Scan history for this domain/api/v1/domain/history/github.gzp18410026550.workers.dev?limit=15

This website contacted 14 IPs in 2 countries across 5 domains to perform 168 HTTP transactions. The main domain is workers.dev and was registered 7 years ago.

Submitted URL: http://github.gzp18410026550.workers.dev/features/ai

Effective URL:

https://github.gzp18410026550.workers.dev/features/ai

Redirected

AI Security Verdict

Moderate Risk

Confidence: 65%

Risk Score

A GitHub-branded 'GitHub AI/Copilot' page served from an unrelated free workers.dev subdomain — clear brand impersonation, but no forms, no credential capture and no malware/Indicators of Compromise were found.

Risk Factors (3)

Impersonation of GitHub's brand and site design on an unrelated workers.dev subdomain

Random/parked-looking tenant identifier in the hostname (gzp18410026550) with no legitimate tie to GitHub

Unranked domain (not in Cisco Umbrella top 1M) and unknown subdomain creation date on shared hosting

Safety Factors (2)

Suricata alerts are informational-only (observed workers.dev DNS/TLS traffic), not phishing or malware signatures

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 5 to 3

Domain age information unavailable

Details

Page Title

GitHub AI · AI built into every step of your workflow · GitHub

Scan Type

public

Domain Name Analysis

The domain 'github.gzp18410026550.workers.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'github.gzp18410026550'. The second-level label 'workers' is 7 characters long split between 2 vowels and 5 consonants. Segmentation suggests one word: workers. Expect 7 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

6.83s

Total Load Time

3.3 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:5,995 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software66% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

66%

documentation technical

39%

forum community discussion

33%

Detected Features

OG: object

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
12	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
12	185.199.109.215Fastly · CDN	United States	AS54113Fastly, Inc.
12	13.33.187.16Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
12	140.82.112.22	United States	AS36459GitHub, Inc.
12	140.82.121.5	Frankfurt am Main, Hesse, Germany	AS36459GitHub, Inc.
12	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
12	185.199.111.215Fastly · CDN	United States	AS54113Fastly, Inc.
12	185.199.110.215Fastly · CDN	United States	AS54113Fastly, Inc.
12	185.199.108.215Fastly · CDN	United States	AS54113Fastly, Inc.
12	13.33.187.2Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
168	14	-	-