The most wanted files
Bots' most wanted file: /.env
Asked for 14 times by 10 scanners across 3 sites. They looked for .env in 66 different places.
Wednesday, Oct 7, 2026 (UTC) · see the latest
191
files hunted
66
.env spots
14
asks for #1
How I measure
Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.
The top 20
Movement is against the day before.
| # | File | Requests | Scanners | Sites | Move |
|---|---|---|---|---|---|
| 1 | /.env | 14 | 10 | 3 | |
| 2 | /api/graphql | 4 | 4 | 1 | |
| 3 | /cgi-bin/php | 4 | 2 | 1 | |
| 4 | /../.env | 4 | 1 | 1 | |
| 5 | /.env.backup | 4 | 3 | 1 | |
| 6 | /.env.bak | 4 | 3 | 1 | |
| 7 | /.env.old | 4 | 3 | 1 | |
| 8 | /.env.production | 4 | 3 | 1 | |
| 9 | /.env.save | 4 | 3 | 1 | |
| 10 | /.env.txt | 4 | 2 | 2 | |
| 11 | /.git/config | 4 | 4 | 1 | |
| 12 | /graphql | 4 | 4 | 1 | |
| 13 | /_ignition/execute-solution | 4 | 1 | 1 | |
| 14 | /index.php | 4 | 2 | 1 | |
| 15 | /info.php | 4 | 3 | 1 | |
| 16 | /_profiler/phpinfo | 4 | 1 | 1 | |
| 17 | /userfiles | 4 | 1 | 1 | |
| 18 | /admin/.env | 3 | 2 | 1 | |
| 19 | /api/.env | 3 | 2 | 1 | |
| 20 | /app/.env | 3 | 2 | 1 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 8
77% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
The AI Key Heist · Oct 8
Bots went hunting for AI keys 847 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 8
95% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.