Sorting the shelf
What a GitHub Listing Actually Hands You
Four things separate one listing from the next here, and every one of them is written into the title or the format line.
History behind the login
Ages run from fresh, through 10+ days and three to nine months, up to one, two and three years. The volume batch is sold as a floor of one year and not a named creation date, and it puts the signup date in the delivered string so you can check each line yourself.
How much of the mailbox
Manual mixed-IP lines confirm the address and hand over the inbox password. The one-year-plus batch notes that no password for the email comes with it. One EU line goes the other way and supplies a separate IMAP password.
The 2FA secret
A large share of the catalog states two-factor enabled. Sellers deliver the secret, not an app, and point at a browser generator to turn it into a six-digit code at sign-in.
The developer credential
Two appear. A ghp_ API key already created on the account, and a personal access token (classic) described as full access. Each sits in its own field in the format line.
Formats
Reading the Colon-Separated String Before You Pay
Four format strings cover almost the whole page. They carry different fields in a different order, which is the most common way a working batch gets misread.
FORMATUsername:Password:TwoFa:DateSignup:ApiKey:Email
The one-year-plus batch. Signup date is its own field, so the claimed age is verifiable per line instead of per listing, and the API key arrives alongside the login.
FORMATlogin:password:email:password
The manually registered GitHub accounts on mixed IPs. Two passwords in one line, the site one then the mailbox one. Feed them in the wrong order and the login fails for a reason that has nothing to do with the account.
FORMATlogin:password:email:emailpassword:IMAP_PASSWORD
The EU line adds a dedicated mail credential because the seller expects you to pull mail over IMAP, not open that inbox in a browser.
FORMATEmail:GithubPassword:2FA:Token:ProfileURL
The aged 2FA family. Profile URL sits last on purpose, because the same sellers want you to load it before you sign in.
ACCESSWeb interface and Git over SSH or HTTPS
One supplier states both routes explicitly. Others describe browser access only, which matters if your work runs through a client, not the site.
ORIGINMIX IP manual, USA auto, EU fresh
Manual registration on mixed residential IPs is the largest family, USA automatic registration sits next to it, and the EU line is created on freshly made verified mailboxes.
Age ladder
Ten Days, Nine Months or Three Years of Repository History
Age is quoted four ways on this page, and the wording tells you what the supplier is willing to stand behind.
| What the listing says | What comes with it |
|---|
| Age 10+ days, manual, MIX IP | Email verified and included. The seller asks you to order a handful first and test them, sets a replacement window of about an hour, and requires a screen recording from purchase to failure. |
| 3 to 9+ months, manual | Same mixed-IP family further along, sold on age with mail confirmed and included. No API credential stated. |
| 1 Year+, auto-registered | The batch that carries this page. API key present, signup date delivered per line, mailbox address confirmed but its password withheld. |
| 1-2 or 2-3 years with 2FA | Priced on age and a working two-factor secret together. Part of this family adds the personal access token, part adds email access through a supplier tool. |
Check first
Load the Profile URL Before the First Sign-In
The aged 2FA family attaches an unusual condition, and it is the biggest expensive thing to skip on this page.
Why the sellers insist on it
Every line in that family delivers a profile URL and asks you to open it before authenticating. A page that resolves means the account is live. A page that does not is your replacement claim. Sign in first and several of these suppliers assume the claim is already answered, which is stated in the description instead of hidden in terms.
What the window covers
Cover is limited to accounts that are invalid or cannot be logged into, and it ends at the first successful login. A day is the longest window quoted on this page, half a day is the most common, and the manual mixed-IP batch is measured in minutes. Testing on delivery day is not caution here, it is the whole of your protection.
Mailbox
How Far Your Control Over the Inbox Goes
GitHub accounts with email access are not one thing on this page. Five different arrangements appear, and they decide who can reset the password later.
Recovery follows the inbox, not the account. A line that confirms the address without giving you its password leaves the reset path with the supplier. If long-term ownership matters, choose a listing that says the email is included and set your own details up in the first session.
Fit
What This Stock Suits and Where It Is the Wrong Buy
The descriptions here are unusually specific about intended use, and equally specific about how to lose the account in a week.
Uses the sellers name
Project registration, integration and CI/CD testing, API connections, repository management, webhook checks and service configuration. One EU line states a repository has already been created on the account and that the profile carries no restrictions.
The warm-up they describe
Fork or create a repository, add a README, make a few commits, star projects, follow people. Sellers put the settling period at three to five days before real work, and warn against sudden spikes on a freshly delivered account.
Proxy conditions are hard here
Nearly every written description repeats one requirement: clean private proxies, never free ones. One seller states that an account suspended after a login through a poor VPN gets nothing back, which makes your route part of the purchase.
Where to look instead
Copilot access is sold as its own product on this page and is not implied by a general account. If your work only needs a hosted repository and not GitHub itself, GitLab accounts sit in the same category with their own protocol notes.
Browse Current GitHub Listings
Compare stated age, mailbox access, 2FA and which developer credential comes in the string.
Back to products