Paths & targets

Which repositories the machines read, which cgit endpoints they use, and the small tail of requests for paths that do not exist, such as guessed credential files.

repositories touched

distinct paths

outside /git/

requests aimed at other paths

not found

404s

page assets

css, icons, fonts, js

repository files

.png/.js/.css inside repos

The window contains no page asset. In requests, nothing fetched a stylesheet, a font, an icon, or a script that the cgit interface needs to render. Requests whose path ends in .png or .js are files inside repositories. They come through the cgit plain, tree, and diff views. No client rendered a page. Every band on every chart is a machine that reads markup, and the browser class is a machine with a browser string.

Where the demand goes

The largest repositories by request volume, with served and aborted counts.

Which cgit endpoint

Requests per day by cgit endpoint. A reader opens a tree. A mirror requests every endpoint of every path.

/diff, /plain, /log, /tree, and /commit move together, in the proportions of a sweep rather than browsing.

The loud tail

Paths outside the cgit routes. These requests guess repository names and credential files. The volume is small and the intent is clear.

These requests look like an attack and mostly are not one. The defence budget goes to the fleet that reads legitimate cgit paths, not to a handful of /.env guesses.