git.disroot.org

Legitimate public Forgejo instance. NOT attacker-owned; the attacker registered the username/namespace 'git-ecosystem' on it to look legitimate and host payload binaries. Only the git-ecosystem namespace is malicious. Treat the bare domain as a qualified indicator.