40 Million Fake Commits Flood GitHub’s Public Feed

GitHub icon

LinkedIn icon

YouTube icon

Twitter icon

Bluesky icon

Table of contents

The Month GitHub Public Contributions Exploded<br>To date, GitHub remains the most widely used code storage cloud platform. The amount of data pushed to GitHub every year is tremendous. In 2025 alone, GitGuardian’s Public Monitoring platform analyzed more than 2 billion commits. This represents around 5.5M commits per day and an impressive amount of data.<br>However, since July 2026, this number has exploded. In June, the commit rate was stable, at around 8 million commits per day, in line with the increasing trend we had observed over the past months. But starting in mid-July, the commit rate moved to 10 million on the 6th of July, then rose to 18 million on the 25th, up to nearly 40 million on July 31st. This is about 5x the June baseline.<br>Number of commits per day from June to August 5thUpon inspection in our own monitoring, we noticed an unusually large number of commits with similar characteristics:<br>They are created on repositories that use a legitimate-looking username, but a completely random 6-letter lowercase name.<br>They use random e-mail addresses unrelated to the username, hosted on hotmail.com, outlook.com, and icloud.com.<br>The web-flow built-in GitHub user creates them.<br>They contain a long commit message that often contains the whole pushed file: only one per commit.<br>The committed files contain a mix of Chinese characters, domain names, URLs, and AI-generated images. Each repository can contain more than a thousand different files.<br>One of the many similar ad bearing repositoriesIn recent days, the number of those commits has become so high that it represents the majority of observable public events. Querying the GitHub Archive database, at the time of writing, out of the last 1,000 observed events, 728 are linked to those commits.<br>Similarly, this activity is now so dominant that querying GitHub’s public events feed yields mostly spam data.<br>$ curl "https://api.github.com/events?per_page=100" | jq .[].repo.name<br>fairchip250/hkrkor<br>rapidhawk0220/nxxrlb<br>bjarstae71/hdwvnf<br>bakbardo/ffgfkj<br>jppsmc/sgmcib<br>assanivewar9/lssorn<br>quiettree28943/tmvhqz<br>saxihafte/njzgow<br>se6776998/lylwts<br>emeraldtree3745/dvaeei<br>amberbyte5998/drqftk<br>runtechx/dns.runtech.ao<br>winder67fogr/genvcp<br>[...]In fact, the public event feed is currently saturated, with the maximum capacity of 300 events at any given time reached.<br>$ curl -I "https://api.github.com/events?per_page=100"<br>HTTP/2 200<br>[..]<br>link: ; rel="next", ; rel="last"What’s the point of this?<br>Most of the commits in this campaign reference short domain names hosted under the .cc and .vip TLDs. On a subset of 1,000,000 commits, we identified about 50 different domains. The whois data for those domains does not provide any meaningful information about their owners, except for one, RE87[.]VIP, which discloses a registrant organization name:<br>$ whois RE87[.]VIP<br>Domain Name: re87[.]vip<br>[...]<br>Registrant Organization: zhou yong kangA reverse whois lookup on this name lands a hundred additional, similar-looking domains, registered between December 2025 and July 2026.<br>The hostnames point to various IP addresses, some of which are shared. The 50 domains in our studied sample pointed to 22 different IP addresses. Most of those addresses are hosted in Hong Kong, on different AS (autonomous systems, the blocks of IP addresses each network operator manages independently):<br>CLOUDIE-HKD<br>CLOUDIE-HK<br>VAPELINE1-HK<br>NET4-9558400015 (HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED) via COGENT-149-88-16<br>RONGHE-HK<br>It is worth noting that the same domain set is also found advertised on other websites, mainly the Russian social network VK.<br>Querying the hosts over HTTP returns a simple page, consisting mainly of a JS script (domains modified to avoid unwanted browsing).<br>// 定义不同设备类型的域名列表<br>const mobileUrls = [<br>'https://m.kwck37y5-ry556com[.]xyz',<br>'https://m.q9sk3enp-ry557com[.]xyz',<br>'https://m.gkbxm4zj-ry556com[.]xyz'<br>];

const desktopUrls = [<br>'https://kwck37y5-ry556com[.]xyz',<br>'https://q9sk3enp-ry557com[.]xyz',<br>'https://gkbxm4zj-ry556com[.]xyz'<br>];

// 检测设备类型<br>function detectDeviceType() {<br>const userAgent = navigator.userAgent;<br>const isMobile = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(userAgent);<br>return isMobile ? 'mobile' : 'desktop';

// 测试域名打开速度<br>function testUrls(urls, callback) {<br>const results = [];<br>const startTime = Date.now();

// 测试每个域名的响应速度<br>urls.forEach((url, index) => {<br>const img = new Image();<br>img.onload = () => {<br>const endTime = Date.now();<br>results.push({ url, time: endTime - startTime });<br>if (results.length === urls.length) {<br>// 所有域名测试完成，调用回调函数<br>callback(results);<br>};<br>img.onerror = () => {<br>// 如果图片加载失败，记录一个较大的时间<br>const endTime = Date.now();<br>results.push({ url, time: 1000 });<br>if (results.length === urls.length) {<br>// 所有域名测试完成，调用回调函数<br>callback(results);<br>};<br>img.src = `${url}/static/local/img/common/b81b0dcdf3f2107f.jpg`; // 假设每个域名下都有一个 test.jpg...