Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10m window.
Origin: DE / AS14061 DigitalOcean, LLC
Active: 14:37:16 UTC
Volume: 1 HTTP req
Probed: /.git/config
Status mix: 444×1
Vhost fishing: 67.217. ...
show more[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 1× edge-block in 10m window.
Origin: DE / AS14061 DigitalOcean, LLC
Active: 14:37:16 UTC
Volume: 1 HTTP req
Probed: /.git/config
Status mix: 444×1
Vhost fishing: 67.217.240.72
UA: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Sent a single GET to /.git/config against the public web server on port 80; the connection was closed without data (HTTP 444), and the session was flagged as a possible exploit by live traffic analysis.
Target: HTTP 80 on the public web site — GET /. ...
show moreSent a single GET to /.git/config against the public web server on port 80; the connection was closed without data (HTTP 444), and the session was flagged as a possible exploit by live traffic analysis.
Target: HTTP 80 on the public web site — GET /.git/config (git repository config enumeration)
Seen: 2026-10-06 09:50 EDT
- 2026-10-06 09:50:57 — a single GET request to /.git/config (HTTP/1.1) with a spoofed Chrome/81 browser user-agent to the public web server on port 80; the connection was closed without returning data (HTTP 444)
- 2026-10-06 09:51:05 — the TCP session to port 80 was flagged by live traffic analysis as a 'Possible Exploit' client fingerprint
show less
