What it looks like
A subdomain on your domain has a CNAME record pointing at user.github.io or the organisation equivalent, and loading that subdomain returns GitHub Pages's unclaimed page rather than a working site. The visible signature is a page containing text along the lines of "There isn't a GitHub Pages site here".
Both signals are needed. A CNAME pointing at GitHub Pages is completely normal when the service is in use. It only matters when the target is no longer claimed.
Why it can be taken over
GitHub allows another account to claim an unverified custom domain, which is why this one is worth acting on quickly. GitHub introduced domain verification to reduce it, but unverified older configurations remain claimable.
What an attacker gets
- Content served from your subdomain, on your domain, usually with a valid certificate that GitHub Pages issues automatically.
- A phishing address that passes every check a cautious person would run, because it genuinely is your domain.
- Access to any cookie your main site scopes to the parent domain, which can include session data.
How to fix it
Remove the CNAME record. If you still want the subdomain, point it at something you control first, then verify the domain in GitHub's settings so it cannot be claimed by another account.
The full removal steps for any provider are in the dangling record guide.
Stopping the next one
These appear whenever a hosted service is trialled and dropped, so a single cleanup does not settle it. The habit worth building is deleting the DNS record in the same sitting as the cancellation, because those are separate actions and only one of them is on anyone's mind.