Security Report: ghcr.alikhodadadi.com - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/bde8462a-14ca-42ad-a0c7-a568ea9d46ec Domain and IP registration (RDAP)/api/v1/rdap/bde8462a-14ca-42ad-a0c7-a568ea9d46ecHow often this domain was scanned/api/v1/domain/stats/ghcr.alikhodadadi.com Scan history for this domain/api/v1/domain/history/ghcr.alikhodadadi.com?limit=15

This website contacted 11 IPs in 2 countries across 5 domains to perform 165 HTTP transactions. The main domain is alikhodadadi.com and was registered 4 years 10 months ago.

Submitted URL: https://ghcr.alikhodadadi.com/

AI Security Verdict

Moderate Risk

Confidence: 68%

Risk Score

Unaffiliated host serving a clone of GitHub's Actions page under GitHub branding, but with no forms, credential capture, malware or threat-intel hits. Deceptive branding, not an active credential phish.

Risk Factors (4)

Presents another organisation's brand (GitHub) as the page's own identity on a domain that does not belong to that organisation

Cloned/mirrored copy of GitHub's product page on an unrelated personal subdomain with no disclosure that it is a copy

Subdomain naming ('ghcr') echoes GitHub Container Registry, which could mislead visitors about affiliation

Unranked host with no verifiable legitimacy signals beyond domain age

Safety Factors (5)

No credential, login or payment form on the page — nothing here harvests user data

No Indicators of Compromise, no malware/hunting-rule matches, no IDS alerts and no obfuscated or exfiltrating JavaScript

Domain has been registered for roughly 4.8 years, which is inconsistent with throwaway phishing infrastructure

Page resources are loaded from GitHub's legitimate CDN/API hostnames, suggesting a mirror rather than a hosted phishing kit

Sign-in/sign-up UI text appears to reference GitHub's own session flow rather than a local credential form

Domain age information unavailable

Details

Page Title

GitHub Actions · CI/CD and automations · Agentic Workflows · Workflows · GitHub

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'ghcr.alikhodadadi.com' is registered; it also runs on subdomain 'ghcr'. The second-level label 'alikhodadadi' is 12 characters long holding 6 vowels versus six consonants. Tokenizing the label suggests 4 words: ali, kho, dada, di. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

5.35s

Total Load Time

3.1 MB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:5,946 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software66% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

66%

forum community discussion

43%

documentation technical

35%

Detected Features

OG: object

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
15	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
15	188.114.96.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
15	185.199.110.215Fastly · CDN	United States	AS54113Fastly, Inc.
15	143.204.181.47Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
15	140.82.114.22	United States	AS36459GitHub, Inc.
15	185.199.109.215Fastly · CDN	United States	AS54113Fastly, Inc.
15	185.199.111.215Fastly · CDN	United States	AS54113Fastly, Inc.
15	185.199.108.215Fastly · CDN	United States	AS54113Fastly, Inc.
15	140.82.113.21	United States	AS36459GitHub, Inc.
15	140.82.121.6	Frankfurt am Main, Hesse, Germany	AS36459GitHub, Inc.
165	11	-	-