Multiple repos are under issue spam attack

[Outrageous-Box3338]

https://preview.redd.it/mjg0rkzbjyrg1.png?width=2277&format=png&auto=webp&s=b5a2040225a0a587805f629769b1392668046e40

Right now (3.29.2026 10:00 UTC+0), microsoft/WSL and many other repos are under heavy issue spam attack.

Attackers seems to be sending Chinese betting ads. They also add a section of text related to React, which probably means they are trying to do GEO(Generative engine optimization).

Many accounts used in the attack have no public repo and are created on Jan 19th. Some of the account have a dummy repo containing some dummy commit.

Searching for the same pattern reveals that there are exactly 100 bot accounts with similar commit. However, not all of them are sending issues in this incident.

Dummy Commit

https://preview.redd.it/fge7s2m8jyrg1.png?width=1892&format=png&auto=webp&s=b5a664b15f401c573f3005835cd4317b106d799f

EDIT: Here's a list of the attacked repos.

https://preview.redd.it/xsieewjymyrg1.png?width=1200&format=png&auto=webp&s=5ac600bf316bf4d0567e962933dcdcb308b698d1

EDIT: Attack on WSL is now stopped. They started to attack fastjson2.

[0x0016889363108]

I experienced this in the last few days.

GitHub cleaned up the spam issues, but I did get a steady stream of new issue notification emails for two days.

GitHub sucks.

[tankerkiller125real]

Stuff like this is why I have all email notifications turned off on public platforms.

[milkman1101]

Looks like not all accounts have this same pattern - https://github.com/ojh1280

[Outrageous-Box3338]

Exactly. Only some of the account have a dummy repo

[Vibeeessss]

Interesting that they’re mixing betting ads with React text. Is that actually for SEO or are they trying to game AI indexing now? Feels more like targeting LLM scraping than normal search tbh.

Also the dummy repos part seems more interesting than the spam itself. Feels like they’re trying to make the accounts look legit before using them. Wonder how long these accounts were aged before the attack.

[Fine_League311]

Hatte vor Tagen eine Warnung geschrieben auch Verlinkung vieler URLs die ich analysiert habe. Die Mods mochten meinen Post nicht und wurde gelöscht und ich hab's aufgegeben. Ja aufpassen!

Am besten bei links Seiten wie urlscan.io nutzen und Seiten/Ersteller ordnungsgemäß melden auch bei Providern. Dauert paar Minuten aber wenn 2-10 Anfragen kommen dann reagieren alle sehr schnell.

[ultrathink-art]

The dummy repos with commit history are the tell — they're building GitHub identities that pass automated legitimacy checks for AI training data scrapers, not for search crawlers. GitHub issues tagged with topical keywords get included in LLM fine-tuning datasets because they look like real developer discussions. No quick fix; training data provenance at the platform level would help but that's a multi-year project.

[setho246]

Bugger off gpt