40 Million Fake Push: When Spam Commits Took Over The Public GitHub

The Month GitHub Public Contributions Exploded

To date, GitHub remains the most widely used code storage cloud platform. The amount of data pushed to GitHub every year is tremendous. In 2025 alone, GitGuardian's Public Monitoring platform analyzed more than 2 billion commits. This represents around 5.5M commits per day and an impressive amount of data.

However, since July 2026, this number has exploded. In June, the commit rate was stable, at around 8 million commits per day, in line with the increasing trend we had observed over the past months. But starting in mid-July, the commit rate moved to 10 million on the 6th of July, then rose to 18 million on the 25th, up to nearly 40 million on July 31st. This is about 5x the June baseline.

Number of commits per day from June to August 5th

Upon inspection in our own monitoring, we noticed an unusually large number of commits with similar characteristics:

• They are created on repositories that use a legitimate-looking username, but a completely random 6-letter lowercase name.
• They use random e-mail addresses unrelated to the username, hosted on hotmail.com, outlook.com, and icloud.com.
• The web-flow built-in GitHub user creates them.
• They contain a long commit message that often contains the whole pushed file: only one per commit.

The committed files contain a mix of Chinese characters, domain names, URLs, and AI-generated images. Each repository can contain more than a thousand different files.

One of the many similar ad bearing repositories

In recent days, the number of those commits has become so high that it represents the majority of observable public events. Querying the GitHub Archive database, at the time of writing, out of the last 1,000 observed events, 728 are linked to those commits.

Similarly, this activity is now so dominant that querying GitHub's public events feed yields mostly spam data.

$ curl "https://api.github.com/events?per_page=100" | jq .[].repo.name
fairchip250/hkrkor
rapidhawk0220/nxxrlb
bjarstae71/hdwvnf
bakbardo/ffgfkj
jppsmc/sgmcib
assanivewar9/lssorn
quiettree28943/tmvhqz
saxihafte/njzgow
se6776998/lylwts
emeraldtree3745/dvaeei
amberbyte5998/drqftk
runtechx/dns.runtech.ao
winder67fogr/genvcp
[...]

In fact, the public event feed is currently saturated, with the maximum capacity of 300 events at any given time reached.

$ curl -I "https://api.github.com/events?per_page=100"
HTTP/2 200
[..]
link: <https://api.github.com/events?per_page=100&page=2>; rel="next", <https://api.github.com/events?per_page=100&page=3>; rel="last"

What's the point of this?

Most of the commits in this campaign reference short domain names hosted under the .cc and .vip TLDs. On a subset of 1,000,000 commits, we identified about 50 different domains. The whois data for those domains does not provide any meaningful information about their owners, except for one, RE87[.]VIP, which discloses a registrant organization name:

$ whois RE87[.]VIP
Domain Name: re87[.]vip
[...]
Registrant Organization: zhou yong kang

A reverse whois lookup on this name lands a hundred additional, similar-looking domains, registered between December 2025 and July 2026.

The hostnames point to various IP addresses, some of which are shared. The 50 domains in our studied sample pointed to 22 different IP addresses. Most of those addresses are hosted in Hong Kong, on different AS (autonomous systems, the blocks of IP addresses each network operator manages independently):

• CLOUDIE-HKD
• CLOUDIE-HK
• VAPELINE1-HK
• NET4-9558400015 (HONGKONG CLOUD NETWORK TECHNOLOGY CO., LIMITED) via COGENT-149-88-16
• RONGHE-HK

It is worth noting that the same domain set is also found advertised on other websites, mainly the Russian social network VK.

Querying the hosts over HTTP returns a simple page, consisting mainly of a JS script (domains modified to avoid unwanted browsing).

const mobileUrls = [
    'https://m.kwck37y5-ry556com[.]xyz',
    'https://m.q9sk3enp-ry557com[.]xyz',
    'https://m.gkbxm4zj-ry556com[.]xyz'
];

const desktopUrls = [
    'https://kwck37y5-ry556com[.]xyz',
    'https://q9sk3enp-ry557com[.]xyz',
    'https://gkbxm4zj-ry556com[.]xyz'
];

function detectDeviceType() {
    const userAgent = navigator.userAgent;
    const isMobile = /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(userAgent);
    return isMobile ? 'mobile' : 'desktop';
}

function redirectToFastestPage(urls) {
    // tests each URL and redirects to fastest
    window.location.href = fastest.url + '/register?key=686868';
}

window.onload = () => {
    const deviceType = detectDeviceType();
    const urls = deviceType === 'mobile' ? mobileUrls : desktopUrls;
    redirectToFastestPage(urls);
};

In essence, those hosts all serve as a redirection for other domains. The script references 3 additional domains that follow a different naming pattern. It checks which of those hosts is the fastest and redirects the browser to it.

This behavior resembles a rudimentary implementation of a well-known technique used by online ad companies to optimize the ad load time on customers' sites.

Here again, there are several second-level domains. From our original sample, we found 9 of them. The set of domains changes every day, and a given "frontend" domain can redirect to a different set of hosts. All second-level hosts are registered under the xyz TLD and resolve to an even smaller set of IP addresses:

• 20.239.43.23
• 20.255.186.227
• 34.96.200.126
• 57.158.72.61
• 57.158.91.185

Those IP addresses all point to Google- or Microsoft-owned data centers in Hong Kong.

Last hop in this rabbit hole: the second-level hosts are queried over HTTPS on a /register endpoint. Querying it triggers a new redirection to a random-looking port on the same host.

$ curl -i https://fhnkzweq-hf332com[.]xyz/register
HTTP/2 307
server: openresty
location: https://fhnkzweq-hf332com[.]xyz:5067/register

As it turns out, the hosts expose a large number of open TCP ports — half of which redirect to the other half at random.

All those layers of indirection ultimately lead to what appears to be a Chinese online gambling application.

Final website is an online lottery application

The copyright line at the bottom translates to "Rúyì cǎi", a name widely reused throughout the whole site. This name matches the consumer brand name used by Beijing Jinruan Ruicai Technology Co, a company that operated paperless lottery services in China between 2010 and 2015. The company ceased online operations in 2015 when the Chinese government declared online lottery illegal.

Apart from impersonating the former lottery company, the site does not appear to have any malevolent behavior. Although some pages recommend downloading and using a VPN in case the site is geofenced, the download links appear to point to somewhat legitimate software (i.e., unknown Chinese VPN software).

Finally, the website advertises its own list of alternative domains that match the patterns and names we observed in the GitHub campaign, likely in an effort to be resilient against takedowns. This technique is common in threat actors' environments to ensure the continuity of illegitimate communication channels.

All in all, this massive campaign appears to have the sole purpose of promoting an illegal online lottery platform.

Same Pipeline, Different Detection

More than the illegal lottery site, the volume of public GitHub activity it took to get there is the interesting point: tens of millions of daily commits, more than 70% of public events, and an events feed pinned at its 300-event cap. At that scale, this spam accounts for the majority of what's visible on one of the Internet's largest public code bases.

It's unclear what the site's owners are trying to achieve with this campaign. The redirect chains and number of registered domains sound sufficient to ensure the site's resilience. The presence of similar advertisements on VK could hint toward SEO optimization techniques: poor ones if we consider the current search results state. What we know for sure is the side effect on GitHub's public metrics: commit counts, repo counts, and active user counts are inflated by activity that has nothing to do with software development. The campaign also shows how, in the AI era, automating bot creation is increasingly easy, even on mature platforms like GitHub.

GitGuardian's Public Monitoring platform watches every commit pushed to GitHub, which is how this pattern surfaced in the first place: a sudden jump above our continuously tracked baseline, from 8 million commits a day in June to 40 million by the end of July. Catching that kind of shift as it happens, across millions of events a day, takes automated monitoring built for that scale.

Most of what we publish from our monitoring pipeline is about exposed secrets: API keys, credentials, and tokens leaking into public repositories. This campaign leaked something else: a redirect chain to an illegal gambling operation, but the mechanism for finding it was the same one we use every day. Whatever gets pushed to a public repository gets seen, credentials or campaign infrastructure alike.