.env Credential File Grab for 2026-10-22

Last Updated: 00:00 UTC

Mass automated probing for .env files that contain database passwords, API keys, and other application secrets. These files are commonly left web-accessible on misconfigured Laravel, Django, and Node.js deployments.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Credentials in Files

Observed URIs

Attackers by Country

United States: 308Germany: 107The Netherlands: 89United Kingdom: 67France: 63Singapore: 60Seychelles: 35Canada: 33Morocco: 30India: 24Bulgaria: 23Indonesia: 16Australia: 14United Arab Emirates: 12Tunisia: 10Türkiye: 8Ivory Coast: 7Brazil: 7Sweden: 6Lithuania: 6Romania: 6Algeria: 6Switzerland: 6Bangladesh: 5Malaysia: 5Finland: 5Russia: 5Japan: 5Ireland: 5Estonia: 4Italy: 4Poland: 4Iran: 4Czechia: 4Ukraine: 4Belgium: 4South Africa: 3Nigeria: 3Nepal: 3Vietnam: 2Philippines: 2Myanmar: 2South Korea: 2Cambodia: 2Colombia: 2Portugal: 2Saudi Arabia: 2Hong Kong: 2Albania: 2Spain: 2Slovakia: 2Austria: 1China: 1Ghana: 1Thailand: 1Israel: 1Latvia: 1Mexico: 1Georgia: 1Argentina: 1Pakistan: 1Laos: 1Iraq: 1Greece: 1Luxembourg: 1Jersey: 1
United States30829.4%
Germany10710.2%
The Netherlands898.5%
United Kingdom676.4%
France636.0%
Singapore605.7%
Seychelles353.3%
Canada333.1%
Morocco302.9%
India242.3%
Bulgaria232.2%
Indonesia161.5%
Australia141.3%
United Arab Emirates121.1%
Tunisia101.0%
Türkiye80.8%
Ivory Coast70.7%
Brazil70.7%
Sweden60.6%
Lithuania60.6%
Romania60.6%
Algeria60.6%
Switzerland60.6%
Bangladesh50.5%
Malaysia50.5%
Finland50.5%
Russia50.5%
Japan50.5%
Ireland50.5%
Estonia40.4%
Italy40.4%
Poland40.4%
Iran40.4%
Czechia40.4%
Ukraine40.4%
Belgium40.4%
South Africa30.3%
Nigeria30.3%
Nepal30.3%
Vietnam20.2%
Philippines20.2%
Myanmar20.2%
South Korea20.2%
Cambodia20.2%
Colombia20.2%
Portugal20.2%
Saudi Arabia20.2%
Hong Kong20.2%
Albania20.2%
Spain20.2%
Slovakia20.2%
Austria10.1%
China10.1%
Ghana10.1%
Thailand10.1%
Israel10.1%
Latvia10.1%
Mexico10.1%
Georgia10.1%
Argentina10.1%
Pakistan10.1%
Laos10.1%
Iraq10.1%
Greece10.1%
Luxembourg10.1%
Jersey10.1%

IP Address : ASN : City/Provider

Share on: