Used to be that way! But actually for security reasons, it was better for us to operate out of a separate domain. The github.com domain is very locked down for good reason.

Also, various boring realities around SSL termination made deployment difficult in a github.com domain. This was the expedient solution. Not phishing!

Likely for a security-driven reason: it’s primarily a marketing site that shouldn’t have access to the .github.com cookie space.

This happens all the time because setting up an entirely new domain yourself is way less work than asking the internal IT team to set up a subdomain for you. If the GitHub IT team is reading this then yes, that means you failed.