GitHub Pages IP 185.199.108.133 flagged as malicious/Port Scan

[RobertP0ghosyan]

[Post removed by author]

[yesalphahere]

GitHub Pages IP Flagged as Malicious / Port Scan

---

What's Happening

GitHub Pages serves all sites from a shared IP range. The IP 185.199.108.133 is one of four GitHub Pages IPs used by millions of sites simultaneously.

185.199.108.133
185.199.109.133
185.199.110.133
185.199.111.133

When your security tool flags it, it's not flagging your site — it's flagging GitHub's shared infrastructure because another site on the same IP triggered a detection.

---

Why It Gets Flagged

Reason	Explanation
Shared IP abuse	Malicious sites hosted on GitHub Pages pollute the IP reputation
Port scanning	Security tools see repeated hits from shared IPs and classify it as a scan
Threat feed lag	Blocklists flag the IP and don't distinguish between sites sharing it
False positive	Your tool sees GitHub's CDN probing behaviour as suspicious

---

What You Should Do

If your security tool is blocking it:

Add the full GitHub Pages IP range to your allowlist:

185.199.108.0/22

This covers all four IPs cleanly without opening broad exceptions.

---

If your site is being flagged to others:

Report the false positive directly to the threat intelligence provider flagging it:

• VirusTotal → Submit for re-analysis
• Cloudflare Radar → Report incorrect classification
• Your AV/firewall vendor → Submit false positive ticket

---

Verify the IP is legitimately GitHub:

nslookup 185.199.108.133
# Should return: cdn-185-199-108-133.github.com

If it resolves to GitHub's CDN, it is legitimate infrastructure — not an attack.

---

What GitHub Can't Do

Since this is a shared IP, GitHub cannot issue a clean dedicated IP for individual Pages sites. This is a known limitation of the Pages infrastructure. If you need an isolated IP, consider:

• Cloudflare proxying your GitHub Pages site (masks the GitHub IP entirely)
• Moving to Vercel or Netlify which offer better IP isolation

---

Bottom Line

The IP is real and belongs to GitHub — the flag is a false positive caused by shared infrastructure abuse by other users. Allowlist 185.199.108.0/22 in your security tool and report the false positive to your threat feed provider.

## GitHub Pages IP Flagged as Malicious / Port Scan

---

What's Happening

GitHub Pages serves all sites from a shared IP range. The IP 185.199.108.133 is one of four GitHub Pages IPs used by millions of sites simultaneously.

185.199.108.133
185.199.109.133
185.199.110.133
185.199.111.133

When your security tool flags it, it's not flagging your site — it's flagging GitHub's shared infrastructure because another site on the same IP triggered a detection.

---

Why It Gets Flagged

Reason	Explanation
Shared IP abuse	Malicious sites hosted on GitHub Pages pollute the IP reputation
Port scanning	Security tools see repeated hits from shared IPs and classify it as a scan
Threat feed lag	Blocklists flag the IP and don't distinguish between sites sharing it
False positive	Your tool sees GitHub's CDN probing behaviour as suspicious

---

What You Should Do

If your security tool is blocking it:

Add the full GitHub Pages IP range to your allowlist:

185.199.108.0/22

This covers all four IPs cleanly without opening broad exceptions.

---

If your site is being flagged to others:

Report the false positive directly to the threat intelligence provider flagging it:

• [VirusTotal](https://www.virustotal.com) → Submit for re-analysis
• [Cloudflare Radar](https://radar.cloudflare.com) → Report incorrect classification
• Your AV/firewall vendor → Submit false positive ticket

---

Verify the IP is legitimately GitHub:

nslookup 185.199.108.133
# Should return: cdn-185-199-108-133.github.com

If it resolves to GitHub's CDN, it is legitimate infrastructure — not an attack.

---

What GitHub Can't Do

Since this is a shared IP, GitHub cannot issue a clean dedicated IP for individual Pages sites. This is a known limitation of the Pages infrastructure. If you need an isolated IP, consider:

• Cloudflare proxying your GitHub Pages site (masks the GitHub IP entirely)
• Moving to Vercel or Netlify which offer better IP isolation

---

Bottom Line

The IP is real and belongs to GitHub — the flag is a false positive caused by shared infrastructure abuse by other users. Allowlist 185.199.108.0/22 in your security tool and report the false positive to your threat feed provider.