The most wanted files
Bots' most wanted file: /.env
Asked for 265 times by 45 scanners across 238 sites. They looked for .env in 451 different places.
Thursday, Oct 8, 2026 (UTC)
2,591
files hunted
▲ +1,257% vs the day before
451
.env spots
▲ +583% vs the day before
265
asks for #1
Every edition: files hunted
How I measure
Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.
The top 20
Movement is against the day before.
| # | File | Requests | Scanners | Sites | Move |
|---|---|---|---|---|---|
| 1 | /.env | 265 | 45 | 238 | – |
| 2 | /.git/config | 204 | 55 | 184 | ▲9 |
| 3 | /.env.production | 169 | 26 | 163 | ▲5 |
| 4 | /.env.local | 168 | 25 | 162 | ▲20 |
| 5 | /.env.backup | 166 | 26 | 162 | – |
| 6 | /.env.bak | 164 | 24 | 160 | – |
| 7 | /.env.old | 164 | 24 | 160 | – |
| 8 | /.env.save | 164 | 24 | 160 | ▲1 |
| 9 | /.env.development | 163 | 22 | 159 | NEW |
| 10 | /.env.swp | 163 | 23 | 159 | NEW |
| 11 | /api/.env | 160 | 19 | 156 | ▲8 |
| 12 | /.env.example | 160 | 22 | 159 | ▲11 |
| 13 | /credentials.json | 159 | 21 | 158 | NEW |
| 14 | /config/.env | 158 | 18 | 155 | NEW |
| 15 | /.env.staging | 158 | 20 | 157 | NEW |
| 16 | /info.php | 158 | 20 | 155 | ▼1 |
| 17 | /phpinfo.php | 158 | 19 | 156 | NEW |
| 18 | /.env.dist | 157 | 19 | 156 | NEW |
| 19 | /app/.env | 156 | 16 | 153 | ▲1 |
| 20 | /backend/.env | 156 | 16 | 153 | NEW |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 8
77% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
The AI Key Heist · Oct 8
Bots went hunting for AI keys 847 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 8
95% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.