They are hunting for a wallet
Thirty-six requests across twenty distinct paths went looking for cryptocurrency material on a server that hosts nothing: seed phrases, mnemonic files, Ethereum keystores. Several of them are prefixed with a repository directory, which is the whole idea - the scanner is betting that somebody committed a wallet file into version control and then published the repository folder along with the site. There is no exploit in any of this. It is a filename guess against a file that should never have been reachable.
Twenty different paths this week, all looking for the same thing: a crypto wallet.
Nothing is hosted on this address. No wallet, no application, no repository. The requests arrive anyway.
Sorted by path, the shopping list is legible. Seed phrases. Mnemonic files. Ethereum keystore directories.
Look at how several of them start, though. They are prefixed with a version control directory. That is not a mistake, that is the wager.
The scanner is betting that somebody committed a wallet file to a repository, pushed it, and then deployed the repository folder along with the site. If that happened, the file sits there at a name anyone can guess.
No vulnerability is involved. Nothing is exploited. It is a filename, asked for politely.
The worst leaks are rarely broken code. They are a file that was correct to have and wrong to ship.
Audit what your repository directory exposes to the web.
#linux#security#selfhosted#infosec#webdev
❯ Audit what your repository directory exposes to the web.