GitHub do say in their post: > These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. ..."multiple sites" could p

GitHub do say in their post: > These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. ..."multiple sites" could possibly refer to a compromised list, like Adobe? Of course, it doesn't have to be Adobe - Macrumors was compromised recently, etc etc.