GitGuardian traces GitHub's 40-million-commit spam flood to an illegal lottery network

What GitGuardian found

GitHub's public commit volume roughly quintupled during July 2026, and nearly all of the growth is spam, according to GitGuardian. Writing on dev.to, the firm says its Public Monitoring platform analyzed more than two billion commits in 2025 — around 5.5 million per day — and that daily volume held near 8 million through June 2026. The curve then bent sharply upward: 10 million commits on July 6, 18 million by July 25, and close to 40 million by the end of the month, roughly five times the June baseline.

Inspecting the flood, GitGuardian found the commits share a clear signature. They land in repositories whose owners have plausible-looking usernames but whose repository names are random strings of six lowercase letters. The commit author emails are unrelated to those usernames and sit on hotmail.com, outlook.com and icloud.com. The commits are attributed to GitHub's built-in web-flow identity, the one attached to changes made through the site's browser interface rather than a git client. Each commit typically carries a single file, and the commit message often repeats that file's entire contents.

The files themselves mix Chinese text, domain names, URLs and AI-generated images, and a single repository can hold more than a thousand of them.

The public events feed is saturated

The campaign now dominates GitHub's observable public activity. GitGuardian reports that a query against the GitHub Archive showed 728 of the last 1,000 observed public events were tied to these commits. The GitHub events API, which buffers a maximum of 300 events at any given time, is pinned at that ceiling and serves an almost unbroken stream of the spam repositories.

Where the links lead

The commits advertise short domains under the .cc and .vip top-level domains. In a sample of one million commits, GitGuardian counted about 50 distinct domains. Whois records for them are mostly uninformative, except for one .vip domain whose registrant organization is disclosed; a reverse whois search on that name surfaced roughly a hundred additional, similar domains registered between December 2025 and July 2026.

The 50 sampled domains resolve to 22 IP addresses, most hosted in Hong Kong across several network operators. GitGuardian also found the same domains being advertised on VK, the Russian social network.

Fetching the pages returns little besides a script that detects whether the visitor is on mobile or desktop, measures which of three candidate hosts responds fastest, and redirects the browser there — a crude imitation of load-optimization techniques used by the online advertising industry. Those second-level hosts, nine of which appeared in the sample and all registered under the .xyz TLD, rotate daily and resolve to just five IP addresses inside Google- and Microsoft-operated data centers in Hong Kong. Each host exposes a register endpoint that answers with a redirect to a random-looking port on the same machine, and the hosts keep large numbers of TCP ports open, with half of them randomly forwarding traffic to the other half.

An illegal lottery at the end of the chain

Every layer of indirection terminates at what GitGuardian describes as a Chinese online lottery application. The site's branding, which translates to "Ruyi cai", matches the consumer brand name used by Beijing Jinruan Ruicai Technology, a company that ran paperless lottery services in China from 2010 until the government outlawed online lottery in 2015 and it ceased operating.

Beyond impersonating the defunct operator, the site does not appear to do anything overtly malicious. Some pages recommend downloading a VPN if access is geofenced, with links that point to unknown but seemingly genuine Chinese VPN software. The site also publishes its own list of alternative domains matching the patterns seen in the GitHub campaign, a resilience tactic commonly used to survive takedowns. GitGuardian's conclusion is that the tens of millions of daily commits serve a single purpose: promoting an illegal lottery platform.

Why it matters

The scale here is the story. When one automated campaign can consume more than 70 percent of GitHub's public event stream and hold the events API at its capacity limit, a data source that researchers, integrations and security tooling rely on becomes significantly less useful — legitimate activity is simply crowded out.

It also demonstrates how GitHub's free hosting and browser-based commit flow can be industrialized as a distribution channel for spam, at a volume that strains any monitoring pipeline built on the assumption of human-scale activity. And although the payload is an illegal gambling site rather than malware, the infrastructure behind it — rotating domains, layered redirects, ports flanked across cloud provider IPs — mirrors the tradecraft of established threat actors. Whatever GitHub's response turns out to be, the filtering heuristics this incident forces will matter well beyond lottery spam.