.env Credential File Grab for 2026-10-21

Last Updated: 00:00 UTC

Mass automated probing for .env files that contain database passwords, API keys, and other application secrets. These files are commonly left web-accessible on misconfigured Laravel, Django, and Node.js deployments.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Credentials in Files

Observed URIs

Attackers by Country

United States: 182The Netherlands: 59Morocco: 53Germany: 50France: 48Singapore: 39United Kingdom: 32Bulgaria: 21India: 20Canada: 16Indonesia: 13Ireland: 10Japan: 8Romania: 8Switzerland: 8Türkiye: 6Tunisia: 5Australia: 5Nigeria: 4Russia: 4Czechia: 4Iran: 4Sweden: 4South Africa: 4Spain: 4Vietnam: 3Thailand: 3Italy: 3Iraq: 3Bangladesh: 2South Korea: 2Brazil: 2Ghana: 2Seychelles: 2Belgium: 2Slovakia: 2Bermuda: 2Ivory Coast: 1Cambodia: 1Philippines: 1Malaysia: 1Azerbaijan: 1Portugal: 1Austria: 1Cyprus: 1Kosovo: 1Egypt: 1Dominican Republic: 1Hong Kong: 1Taiwan: 1Algeria: 1Lithuania: 1Albania: 1
United States18227.8%
The Netherlands599.0%
Morocco538.1%
Germany507.6%
France487.3%
Singapore396.0%
United Kingdom324.9%
Bulgaria213.2%
India203.1%
Canada162.4%
Indonesia132.0%
Ireland101.5%
Japan81.2%
Romania81.2%
Switzerland81.2%
Türkiye60.9%
Tunisia50.8%
Australia50.8%
Nigeria40.6%
Russia40.6%
Czechia40.6%
Iran40.6%
Sweden40.6%
South Africa40.6%
Spain40.6%
Vietnam30.5%
Thailand30.5%
Italy30.5%
Iraq30.5%
Bangladesh20.3%
South Korea20.3%
Brazil20.3%
Ghana20.3%
Seychelles20.3%
Belgium20.3%
Slovakia20.3%
Bermuda20.3%
Ivory Coast10.2%
Cambodia10.2%
Philippines10.2%
Malaysia10.2%
Azerbaijan10.2%
Portugal10.2%
Austria10.2%
Cyprus10.2%
Kosovo10.2%
Egypt10.2%
Dominican Republic10.2%
Hong Kong10.2%
Taiwan10.2%
Algeria10.2%
Lithuania10.2%
Albania10.2%

IP Address : ASN : City/Provider

Share on: