9 Accounts, 552 Repos, 34 Minutes
A follow-up to the initial discovery of 8 GitHub accounts with suspiciously similar following lists has expanded the cluster to 9 accounts. The new account, lynewinter, shares a Jaccard similarity of 0.9898 with mariwatts — 6,642 times the expected overlap under a naive uniform model. The full cluster now includes: canestein, hazexone, domcomit, kylehyne, jaderytm, vierystein, hanyvert, mariwatts, and lynewinter (partial coverage).
Each account has 57–63 public repositories, totaling 552. Every repository was created on May 12, 2026. Fetching the first repository per account revealed an HTML comment in the README containing a creation timestamp and job ID:
The timestamps span 34 minutes, from 11:10:39 to 11:44:30 UTC. Job IDs are non-sequential, consistent with concurrent dispatching from a job queue.
Structural Uniformity
All sampled repositories follow the same pattern: a class stub with a single method containing only self.logger.info("Add your main logic here"). No functional code. Repository names follow a [Word][Suffix] pattern with suffixes like Core, Chain, Sync, Vault, Forge, Link. Examples: BlockLink, GasSync, MintChain.
Second-Order Similarity
Beyond direct following overlap, the investigation computed cosine similarity of Jaccard vectors across accounts. All pairwise values exceed 0.9999. While partly an artifact of low variance, the near-zero structural differentiation is consistent with a shared generation source — unlike organic networks where accounts occupy different community positions.
Pipeline Fingerprint
The fallback_ prefix in every README comment matches artifacts from an earlier operation nine months prior, linked to the same GitHub identity (hajigur69). Four accounts from Part 1 appear in both operations. The pipeline left recoverable artifacts in every repository it produced, enabling cross-temporal linkage.
Boundary Cases
lynewinter is the weakest link: its cluster membership rests on a single confirmed pairwise value against mariwatts. Removing it leaves the original 8-account finding unchanged. hazexone and lynewinter are peripheral, with mean within-cluster similarity ~0.991 vs ~0.997 for the core group.
Methodology
All data comes from public GitHub REST API v3 endpoints, raw git metadata, and WHOIS/DNS records. No private repositories or leaked credentials were accessed. Jaccard similarity, set intersection, and cosine similarity of similarity vectors were used. The null baseline model assumes independent uniform selection, yielding expected Jaccard ~0.000149; observed minimum is 0.9898.
What This Analysis Cannot Establish
The report explicitly states what it cannot prove: who controls the accounts, whether hajigur69 is operator or compromised identity, or intent. Inference is labeled throughout. The confirmed findings table lists only directly observable, API-verifiable data.
Next Steps for Developers
If you maintain a GitHub organization, audit your follower graph for accounts with unusually high overlap. Check for repository creation clusters within short time windows. The fallback_ comment pattern in READMEs is a specific artifact to search for. The full methodology is reproducible with a GitHub token.
