GitHub

Software & cloud United Statesgithub.comRank 212 of the most impersonated
Cert findings · 24 h
7
Cert findings · 7 days
8
8 on phishing hosts
Registered lookalikes
236
50 listed by a source or an address list
Official domains
17
verified from GitHub's own sites and records

Certificate findings for GitHub

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to GitHub's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 11 findings, grouped by hostname

  1. r.mail.talent-github.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    r.mail.talent-github.com
    First seen
    2026-11-05 10:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.246.243.65
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-05 09:02 UTC to 2027-02-03 09:02 UTC
    Logged 2026-11-05 10:01 UTC in DigiCert Sphinx2027h1, entry 365,612,944
    SHA-256 5a8e421830368aca465d329f975f79adf9307c7004f2dd7af0cb982a9ccfcd64
    Public key SHA-256 8fda1c61f526e435468684f67af9955c25c46b188b211fe1d477d2c1e37f23de
    Brand
    GitHub
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    talent-github.com
    MX
    Receives mail at webhost.dynadot.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 10:09 UTC

    Suggest a correction

  2. githubgithub.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    githubgithub.com
    First seen
    2026-11-05 09:05 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.245.213.78.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.245.213.78
    Brand
    GitHub
    Addresses
    216.245.213.78 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    216.245.213.74 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    githubgithub.com
    Registered
    2020-06-12 · Media Elite Holdings Limited, S.A.
    MX
    Receives mail at mail.h-email.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:27 UTC

    Suggest a correction

  3. githubplus.com US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    githubplus.com
    First seen
    2026-11-05 09:02 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.31.3.235.
    1. Phishing-host list fetched with the address
    2. Resolved to 64.31.3.235
    Brand
    GitHub
    Addresses
    64.31.3.235 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    37.48.77.82 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    githubplus.com
    Registered
    2021-07-29 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  4. github.cm US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    github.cm
    First seen
    2026-11-05 09:00 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.60.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.60
    Brand
    GitHub
    Addresses
    69.162.80.60 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    212.7.194.67 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    github.cm
    Registered
    2015-11-02 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  5. apirif.claude-githubusercontent.com IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    apirif.claude-githubusercontent.com
    First seen
    2026-11-04 23:41 UTC
    First published
    2026-11-05 00:41 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.143.233.133
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 22:29 UTC to 2027-02-02 22:28 UTC
    Logged 2026-11-04 23:27 UTC in IPng Networks Halloumi2027h1, entry 366,958,824
    SHA-256 f568d9672d3cea01880c1eca950dd4ac05a122cae48b358ecb5d07aa686f4ef7
    Public key SHA-256 958482a4dc67a238d1d0c595a13262e61c096505d880c4c5b7cc6efcc01f1876
    Brand
    GitHub
    Addresses
    185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    Domain
    claude-githubusercontent.com
    Registered
    2026-10-02 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  6. www.github-tracker.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.github-tracker.com
    First seen
    2026-11-04 17:21 UTC
    First published
    2026-11-04 18:05 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 16:10 UTC to 2027-02-02 16:10 UTC
    Logged 2026-11-04 17:08 UTC in IPng Networks Gouda2027h1, entry 316,476,370
    SHA-256 abdc49c19486db22b8cf144597610601930671e61c2720e2ff6fd5ce4f4edc54
    Public key SHA-256 57c727fe3b13c543f163903c92b44e5f5fe6a5a8168251ba508b7484c0f09574
    Brand
    GitHub
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    github-tracker.com
    Registered
    2026-08-13 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:06 UTC

    Suggest a correction

  7. github-tracker.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    github-tracker.com
    First seen
    2026-11-04 17:21 UTC
    First published
    2026-11-04 18:05 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 16:10 UTC to 2027-02-02 16:10 UTC
    Logged 2026-11-04 17:08 UTC in IPng Networks Gouda2027h1, entry 316,476,370
    SHA-256 abdc49c19486db22b8cf144597610601930671e61c2720e2ff6fd5ce4f4edc54
    Public key SHA-256 57c727fe3b13c543f163903c92b44e5f5fe6a5a8168251ba508b7484c0f09574
    Brand
    GitHub
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    github-tracker.com
    Registered
    2026-08-13 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:06 UTC

    Suggest a correction

  8. apilil.claude-githubusercontent.com IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    apilil.claude-githubusercontent.com
    First seen
    2026-10-31 18:52 UTC
    First published
    2026-10-31 19:03 UTC
    DNS
    Resolves · checked 2026-11-04 19:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.143.233.133
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-31 17:49 UTC to 2027-01-29 17:49 UTC
    Logged 2026-10-31 18:48 UTC in Google ParcelYard2027h1, entry 543,455,170
    SHA-256 7c580445ca37be5a75efc980005a35d6393a33dd5ce6ebcc109e76d07b333db1
    Public key SHA-256 155296a36ac35aa558215d3aa176b355f21cd449a57e58ef6d2ceec9e7c559a3
    Brand
    GitHub
    Addresses
    185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
    Domain
    claude-githubusercontent.com
    Registered
    2026-10-02 · Spaceship, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  9. www.github-yaxin.com US · AS393437 · KLAYER LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.github-yaxin.com
    First seen
    2026-10-29 06:32 UTC
    First published
    2026-10-31 07:18 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 72.244.91.252.
    1. Resolved to 72.244.91.252
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    GitHub
    Addresses
    72.244.91.252 · United States · AS393437 KLAYER - KLAYER LLC
    Domain
    github-yaxin.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  10. github-yaxin.com US · AS393437 · KLAYER LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    github-yaxin.com
    First seen
    2026-10-29 06:32 UTC
    First published
    2026-10-31 07:18 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 72.244.91.252.
    1. Resolved to 72.244.91.252
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    GitHub
    Addresses
    72.244.91.252 · United States · AS393437 KLAYER - KLAYER LLC
    Domain
    github-yaxin.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  11. github-repository.gl SC · AS197170 · TECHTIES-AS TechTies Inc.
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    github-repository.gl
    First seen
    2026-10-29 03:36 UTC
    First published
    2026-10-29 04:38 UTC
    DNS
    Resolves · checked 2026-11-05 04:50 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 94.26.106.118.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 94.26.106.118
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-29 02:33 UTC to 2027-01-27 02:33 UTC
    Logged 2026-10-29 03:32 UTC in Geomys Tuscolo2027h1, entry 390,114,451
    SHA-256 71066e0bfb9fd9c57b3f10b1ab7b5acd6a422a190495aa127f9c5d095bf7c1a2
    Public key SHA-256 153b57665decc8e61464a10412affe87713d411f224e4e648ca991292faf8f81
    Brand
    GitHub
    Addresses
    94.26.106.118 · Seychelles · AS197170 TECHTIES-AS TechTies Inc.
    Domain
    github-repository.gl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches GitHub when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Software & cloud

All brands →