Well, i request cd after checking even SSL certificate, seams legit. But why?

Do you think they collect addresses of repository owners?