.env Credential File Grab for 2026-10-20

Last Updated: 00:00 UTC

Mass automated probing for .env files that contain database passwords, API keys, and other application secrets. These files are commonly left web-accessible on misconfigured Laravel, Django, and Node.js deployments.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Credentials in Files

Observed URIs

Attackers by Country

United States: 149Singapore: 36The Netherlands: 33Germany: 33Belgium: 31Japan: 27Taiwan: 23Canada: 17Brazil: 16France: 10India: 5Ireland: 5Finland: 4United Kingdom: 3South Korea: 2Bulgaria: 2Switzerland: 2Iran: 1Indonesia: 1Thailand: 1Italy: 1South Africa: 1Australia: 1Argentina: 1Hong Kong: 1Romania: 1
United States14936.6%
Singapore368.8%
The Netherlands338.1%
Germany338.1%
Belgium317.6%
Japan276.6%
Taiwan235.7%
Canada174.2%
Brazil163.9%
France102.5%
India51.2%
Ireland51.2%
Finland41.0%
United Kingdom30.7%
South Korea20.5%
Bulgaria20.5%
Switzerland20.5%
Iran10.2%
Indonesia10.2%
Thailand10.2%
Italy10.2%
South Africa10.2%
Australia10.2%
Argentina10.2%
Hong Kong10.2%
Romania10.2%

IP Address : ASN : City/Provider

Share on: