Spike in Git Configuration Crawling Highlights Risk of Codebase Exposure

Summary: GreyNoise observed a significant increase in crawling activity targeting Git configuration files on April 20-21, 2025, with nearly 4,800 unique IP addresses daily, marking the largest of four spikes since September 2024. The traffic was globally distributed, with Singapore the top source and destination, followed by the U.S. and Germany, and 95% of IPs engaged in this behavior over the past 90 days are confirmed malicious.
Bottom line: Exposed Git configuration files can lead to internal codebases, developer workflows and credentials being exposed - and in 2024 a Git configuration breach exposed 15,000 credentials and resulted in 10,000 cloned private repositories.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2021-23263