--- title: 40 Million Fake Commits Flood GitHub’s Public Feed description: Since mid-July 2026, GitHub's public event feed has been overwhelmed by a massive spam campaign generating up to 40 million fake commits per day — roughly 5x... canonical: https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 40 Million Fake Commits Flood GitHub’s Public Feed | daily.dev og:description: Since mid-July 2026, GitHub's public event feed has been overwhelmed by a massive spam campaign generating up to 40 million fake commits per day — roughly 5x... og:url: https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1 og:image: https://api.daily.dev/og/posts/hUhngHKm1.png og:image:alt: 40 Million Fake Commits Flood GitHub’s Public Feed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 40 Million Fake Commits Flood GitHub’s Public Feed **[GitGuardian](https://daily.dev/sources/gitguardian)** · 7 min read · 8 upvotes · 1 comments ## Summary Since mid-July 2026, GitHub's public event feed has been overwhelmed by a massive spam campaign generating up to 40 million fake commits per day — roughly 5x the June baseline and over 70% of all observable public events. GitGuardian's monitoring detected the anomaly by tracking a sudden spike above the normal 8M daily commit rate. Investigation revealed the commits share common traits: random 6-letter repo names, unrelated email addresses, and files containing Chinese characters, domain names, and AI-generated images. Tracing the redirect chain through dozens of .cc and .vip domains hosted in Hong Kong ultimately leads to an illegal Chinese online gambling site impersonating a defunct lottery brand. The campaign appears aimed at promoting the gambling platform and ensuring its resilience against takedowns via a large pool of rotating domains. A side effect is that GitHub's public metrics — commit counts, repo counts, active users — are now significantly inflated by non-development activity, illustrating how easy bot-driven automation has become even on mature platforms. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is GitHub's public events API returning mostly spam repositories right now? A massive spam campaign has flooded GitHub's public feed with fake commits from randomly-named accounts, pushing daily commit volume from an 8 million baseline in June to nearly 40 million by July 31st. These commits, created via GitHub's web-flow user with random hotmail/outlook/icloud emails, now account for over 70% of public events, saturating the events API's 300-event capacity cap. _Teams tracking anomalies in public GitHub activity can follow security research like this through daily.dev._ ### Where do the redirect chains in the GitHub spam commit campaign ultimately lead? Multi-layered redirects starting from .cc and .vip domains referenced in the spam commits pass through .xyz second-level domains hosted on Google and Microsoft Hong Kong data centers, then through open TCP ports, ultimately landing on a Chinese online gambling site impersonating a defunct lottery brand called Rúyì cǎi, formerly operated by Beijing Jinruan Ruicai Technology Co until it ceased operations in 2015. _Anyone investigating suspicious domain redirect chains can find similar threat research on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@h3l0st3k** · 0 upvotes > This is a fascinating OSINT case. Following infrastructure, domain rotation, and behavioral patterns across millions of events demonstrates how public development platforms can also become valuable sources for tracking coordinated abuse campaigns. ## Similar posts on daily.dev - [News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub](https://daily.dev/posts/news-alert-gitguardian-study-shows-ai-coding-tools-double-leak-rates-as-29m-credentials-hit-github-hkqb5n1dy) · Security Boulevard · 2 upvotes · 0 comments - [GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos](https://daily.dev/posts/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5-500-repos-iymmmkb5w) · CSO Online · 3 upvotes · 0 comments - [Let's talk about AI slop](https://daily.dev/posts/let-s-talk-about-ai-slop-qot1sze9k) · Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"40 Million Fake Commits Flood GitHub’s Public Feed","url":"https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1"},"datePublished":"2026-08-05T14:46:25.977Z","dateModified":"2026-09-14T06:41:41.103Z","description":"Since mid-July 2026, GitHub's public event feed has been overwhelmed by a massive spam campaign generating up to 40 million fake commits per day — roughly 5x...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2e03d5f5743c2e25a6f32a0c9ff12a59?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2e03d5f5743c2e25a6f32a0c9ff12a59?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitGuardian","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitGuardian","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/406f3b707b1741f7b988cf561463a54d","url":"https://daily.dev/sources/gitguardian"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":8},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,github,gitguardian","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitGuardian","item":"https://daily.dev/sources/gitguardian"},{"@type":"ListItem","position":3,"name":"40 Million Fake Commits Flood GitHub’s Public Feed"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1","comment":[{"@type":"Comment","text":"This is a fascinating OSINT case. Following infrastructure, domain rotation, and behavioral patterns across millions of events demonstrates how public development platforms can also become valuable sources for tracking coordinated abuse campaigns.","datePublished":"2026-08-07T14:06:52.894Z","url":"https://daily.dev/posts/hUhngHKm1#c-xv7ZEAyOk","author":{"@type":"Person","name":"H3l!0s_T3k","url":"https://daily.dev/h3l0st3k","image":"https://avatars.githubusercontent.com/u/90980178?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/40-million-fake-commits-flood-github-s-public-feed-huhnghkm1#faq","mainEntity":[{"@type":"Question","name":"Why is GitHub's public events API returning mostly spam repositories right now?","acceptedAnswer":{"@type":"Answer","text":"A massive spam campaign has flooded GitHub's public feed with fake commits from randomly-named accounts, pushing daily commit volume from an 8 million baseline in June to nearly 40 million by July 31st. These commits, created via GitHub's web-flow user with random hotmail/outlook/icloud emails, now account for over 70% of public events, saturating the events API's 300-event capacity cap. Teams tracking anomalies in public GitHub activity can follow security research like this through daily.dev."}},{"@type":"Question","name":"Where do the redirect chains in the GitHub spam commit campaign ultimately lead?","acceptedAnswer":{"@type":"Answer","text":"Multi-layered redirects starting from .cc and .vip domains referenced in the spam commits pass through .xyz second-level domains hosted on Google and Microsoft Hong Kong data centers, then through open TCP ports, ultimately landing on a Chinese online gambling site impersonating a defunct lottery brand called Rúyì cǎi, formerly operated by Beijing Jinruan Ruicai Technology Co until it ceased operations in 2015. Anyone investigating suspicious domain redirect chains can find similar threat research on daily.dev."}}]} ```