I am not exaggerating this:
I created a new hostname in DNS, then added it to my existing webserver config.
It was online for 3 seconds – 3! – before getting a 404 request for /.git/config .
If you’re relying on obscurity to protect your services, get that right out your fool head today. You have about 3 seconds to get your act together.
In the time it took me to type this, I got another 62 requests: