Caught a .git/config crawler - Information Camouflage

My infinite web site generator<br>caught a .git/config crawler.

Last November, I updated my program bork.php to do a better job<br>of creating .git/config files.<br>I noticed in my Apache log files that some apparent bad actors<br>were requesting URLs with a path of .git/config.<br>That particular file name contains the per repository configuration<br>information for the git<br>version control system.<br>Due to its superiority, git has become the single most popular<br>version control system ever.

Just for reference, here&rsquo;s what request body asking my web server<br>for a .git/config URL gives back:

[core]<br>repositoryformatversion = 0<br>filemode = true<br>bare = false<br>logallrefupdates = true<br>[remote "origin"]<br>url = git@github.com:yorgi-gromolski/spintronic-tractor-parts.git<br>fetch = +refs/heads/*:refs/remotes/origin/*<br>[branch "main"]<br>remote = origin<br>merge = refs/heads/main<br>[branch "fuck-you-moron"]<br>url = git@github.com:richard-nixon/fartpipe.git<br>remote = origin<br>merge = refs/heads/fuck-you-moron<br>[branch "nRqEtp3gAecLhY"]<br>url = git@github.com:bZPVQxEKkSVAqw0mrnI/TbdQETY1MxUb1ETu8j.git<br>remote = origin<br>merge = refs/heads/sNvilUBPj8xooSTH<br>The last branch has a randomly-selected name,<br>and a randomly-selected URL.<br>They&rsquo;re different every time someone asks for /.git/config<br>I actually have no idea if this is a valid format for a .git/config file.

Some time in mid-2025, people started actively collecting<br>.git/config files.<br>I am not all that knowledgeable about git, but it looks to me like<br>the contents of .git/config aren&rsquo;t intrinsically valuable.<br>People apparently keep credentials of various sorts,<br>user names and passwords, TLS certificates, etc,<br>in repositories that are under git version control.<br>I found a bad actor that requested /.git/config,<br>then spidered an entirely fictional git repository.

Discovery

Between March and September of 2025,<br>I had my web server send Meta (a.k.a. Facebook) web crawlers<br>into an infinite swamp of garbage.<br>I was curious about the effect on Meta&rsquo;s crawlers,<br>and also leery of the effect on my $4.37 a month VPS,<br>so I kept Apache &ldquo;combined&rdquo; format log files.<br>I still keep them, because then I can look through them<br>for other odd behavior.

From the Apache log files, I made myself a chart<br>showing the number of HTTP requests a day my VPS receives.

The dates in the above chart are UTC.

Notice the tall, narrow spike in June 2026.<br>That&rsquo;s two days, June 19 and 20, where 563057 and 339286<br>requests arrived respectively.<br>For some sense of magnitude, the other days in June 2026<br>range between 96,000 and 120,000 requests per day.<br>Meta ramped up to a maximum of 270,000 requests a day.

After a little futzing around, I discovered that a single IPv4 address,<br>195.178.110.18, had made 434039 of the requests on 2026-06-19,<br>and 220239 of the requests on 2026-06-20.

Date<br>Request count

2025-12-24

2025-12-25

2025-12-28

2026-01-01

2026-01-11

2026-01-12

2026-01-14

2026-02-26

2026-03-04

2026-03-07

2026-03-15<br>1334

2026-03-16<br>380

2026-03-24

2026-03-26

2026-03-28

2026-03-30

2026-04-06<br>21

2026-04-07<br>355

2026-04-10

2026-04-13

2026-04-17

2026-04-23

2026-04-30

2026-05-01

2026-05-16

2026-05-24<br>110

2026-06-17<br>110

2026-06-19<br>434039 ←

2026-06-20<br>220239 ←

2026-06-22<br>225

2026-06-24<br>115

2026-06-25<br>108

2026-06-30<br>225

I piously hope that garbage responses to 650K requests<br>help 195.178.110.18 through its cybercrime journey.

I ran whois against 195.178.110.18 soon after seeing the request count.<br>195.178.110.18 is part of 195.178.110.0/24.<br>Looking through my Apache log files,<br>I found 59 IP addresses in 195.178.110.0/24 that made 699,774 requests.

IP Address<br>Request count

195.178.110.2<br>10

195.178.110.15<br>420

195.178.110.18<br>657317

195.178.110.21

195.178.110.25<br>39

195.178.110.28<br>11

195.178.110.31<br>19

195.178.110.33<br>1474

195.178.110.34<br>748

195.178.110.38

195.178.110.39

195.178.110.48<br>557

195.178.110.54<br>19

195.178.110.57

195.178.110.64

195.178.110.65<br>1490

195.178.110.68<br>258

195.178.110.75<br>56

195.178.110.100<br>12

195.178.110.101<br>172

195.178.110.102<br>1598

195.178.110.103<br>1102

195.178.110.104

195.178.110.108<br>3298

195.178.110.109<br>4027

195.178.110.125

195.178.110.130<br>12

195.178.110.131

195.178.110.132<br>6094

195.178.110.133<br>672

195.178.110.135<br>2108

195.178.110.144

195.178.110.146<br>10

195.178.110.152<br>87

195.178.110.155<br>17

195.178.110.157<br>2289

195.178.110.159<br>3272

195.178.110.160<br>439

195.178.110.161<br>633

195.178.110.162<br>71

195.178.110.163<br>976

195.178.110.164<br>429

195.178.110.186<br>12

195.178.110.187<br>10

195.178.110.190<br>70

195.178.110.191<br>16

195.178.110.195

195.178.110.199<br>8424

195.178.110.201<br>200

195.178.110.204<br>11

195.178.110.218<br>26

195.178.110.222

195.178.110.223<br>410

195.178.110.224

195.178.110.228<br>12

195.178.110.240<br>431

195.178.110.241<br>42

195.178.110.242<br>261

195.178.110.246<br>73

The 195.178.110.0/24 requests date to 2025-03-13,<br>in the earliest log file I kept.<br>Most of the URLs requested by...