LSN โ€” Local Sovereign Network

The Keys Left in the Door: .env, .git and the Anatomy of an Exposed Secret

TI-2026-059E ยท Series: The Front Door ยท Classification: HIGH ยท Confidence: HIGH

Fifth in The Front Door series. 059A established that the modern web threat is secret-file harvesting. This dossier zooms in on the two files that draw the most fire โ€” /.env and /.git/config โ€” and asks a question the raw counts answer for us: why is the git config hunted harder than the env file?

Executive Summary

Two paths dominate the secret hunt at our edge:

PathTotal hitsUnique IPsUnique hosts
/.env68233897
/.git/config91153899

/.git/config is chased by 200 more distinct scanners than /.env. That is not random. It reflects a correct assessment of value by the attackers: a leaked .env gives you today's secrets; a leaked .git gives you every secret ever committed, plus the source code to find the next hole. The env file is a key under the mat. The git directory is the architect's blueprints, the master key, and a list of every key you ever changed the locks to.

The hunt is run by two kinds of operator โ€” ephemeral polyglot sweepers that try every framework's secret file in a five-second burst, and patient specialists that probe only /.git/config from a hosting provider whose documented business is serving APTs and ransomware.

Two Files, Two Blast Radii

.env โ€” the current state. A single file of KEY=value secrets: database passwords, API keys, the SECRET_KEY. Leaking it is bad. But it is bounded โ€” it exposes what is live right now, and rotating those values closes the wound.

.git/config โ€” the entire history. The config file itself is mundane; it is the tell that the whole .git/ directory is web-readable. And that directory is the complete version-control database. With the config exposed, an attacker runs a tool like GitTools or git-exposed, downloads the objects, and reconstructs the full source tree and its entire commit history. That history is the prize:

Rotating your current .env does nothing for a .git leak. The secret you deleted three years ago is back in the attacker's hands.

Archetype 1 โ€” The Polyglot Sweeper

141.227.137.61 (OVH, AS16276, abuse 100) is a masterclass in breadth. In five seconds โ€” 00:00:42 to 00:00:47 on 7 June โ€” it fired 486 requests at 78,484 paths/hour, one per framework's secret file:

/application.properties     (Java / Spring)
/settings.py                (Python / Django)
/config.js                  (Node.js)
/appsettings.json           (.NET)
/wp-config.php.bak          (WordPress backup)
/config.json  /config.php
/.aws/credentials  /.aws/config
/.git/config

It does not know or care what you run. It carries the union of every ecosystem's secret-file convention and throws all of them at the wall in one ephemeral burst from a disposable OVH rental. This is the "spray the dictionary, keep the hit" model โ€” cheap, fast, gone before you notice.

Archetype 2 โ€” The Git Specialist

144.172.97.163 is the opposite temperament. It probes one path only: /.git/config. Sixteen requests, steady, spread over two weeks (16 June โ€“ 1 July). Its /24 siblings โ€” .100.174, .103.103, .106.24 โ€” do exactly the same. No breadth, no burst, no other paths. Just patient, distributed git-hunting.

Single-mindedness like this implies a downstream pipeline: an automated system that only needs the one high-value path because behind it sits auto-clone + secret-extraction + resale. And the address of that pipeline is telling.

144.172.x belongs to AS14956, RouterHosting LLC โ€” Cloudzy. Breakglass Intelligence (March 2026) documents Cloudzy as carrying 40โ€“60% malicious traffic and serving APTs from China, Iran, North Korea and Russia alongside Ryuk and Conti ransomware operations. The same report notes an operator exfiltrating to a Seychelles-registered bulletproof host โ€” the same jurisdiction as TechTies AS197170, the shell we identified in 059A. A dedicated git-harvesting cluster does not sit on Cloudzy by accident.

The Industrial Precedent

This is not theoretical. Sysdig's EmeraldWhale campaign did exactly this at scale: scanned ~500 million IPs across 12,000 ranges for exposed Git config files, cloned more than 10,000 private repositories, and extracted over 15,000 cloud credentials, staging the loot in an AWS S3 bucket. Our 538 git-config scanners are the same behaviour, sampled at one edge. Somewhere upstream, the clones are happening.

Read Between the Lines

Q: Why probe ~100 different hostnames, not just our IP? Because one server hosts many sites. The scanners iterate the HTTP Host header โ€” blog.example, old.example, staging.example โ€” to reach every virtual host behind the address, including the forgotten staging site nobody hardened. Ninety-seven to ninety-nine distinct hosts were probed for these two files. A single unprotected vhost โ€” the catch-all, the legacy subdomain โ€” undoes protection on all the others. The attacker knows your weakest site is not your main one.

Q: If it's all 404s on our edge, who is actually getting hit? The same logic as the whole series: we are one tile in an internet-wide sweep. The 538 scanners are not interested in us specifically; they are enumerating the entire IPv4 space for the fraction that answers 200. EmeraldWhale's 10,000 cloned repos are the answer to "who gets hit" โ€” the careless deploys, the git clone into a web root, the .git that Apache happily serves because nobody told it not to.

Q: Why would a specialist waste two weeks on sixteen requests to one path? Because patience is stealth and the path is enough. A slow, single-path probe from a rotating /24 stays under rate-limit thresholds and blends into background noise, while the one path it wants โ€” /.git/config โ€” is the master key. The specialist has already decided the git directory is worth more than a fast, noisy, broad sweep. Its restraint is a statement about value.

The Alternative Interpretation

Could the git-config hunt be defensive โ€” attack-surface-management vendors or bug-bounty hunters checking clients for exposed .git, a genuinely useful service?

For part of the long tail, yes. But the specialists fail the test. A legitimate ASM vendor scans its own customers from identified, reverse-DNS-verifiable infrastructure and publishes its ranges. The Cloudzy cluster scans indiscriminately, from forged-UA nodes, on a provider independently documented as APT-and-ransomware hosting, and gets banned by CrowdSec and MikroTik for its trouble. Bug-bounty recon does not launch from a network that is 40โ€“60% malicious. The benign framing explains the researchers; it cannot explain the neighbourhood they operate from.

Verdict

/.git/config outdraws /.env because the attackers have correctly priced the two: the env file is the present, the git directory is the entire past, source code included. The hunt runs on two archetypes โ€” disposable polyglot sweepers on hyperscale clouds and patient single-path specialists on documented bulletproof hosts (Cloudzy AS14956) โ€” feeding a clone-and-extract pipeline whose industrial form is EmeraldWhale. Confidence: HIGH on the behaviour, the two archetypes and the value asymmetry; MEDIUM on the specialists' downstream monetisation model.

Defensive Response

Sources

Investigation TI-2026-059E ยท The Front Door series ยท /.env (338 IPs) vs /.git/config (538 IPs); polyglot sweepers vs Cloudzy git specialists ยท Cross-referenced with EmeraldWhale (Sysdig) and Cloudzy analysis (Breakglass) ยท Confidence: HIGH.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Front Door โ€” 5 / 6 Next โ†’