Environment File Variant Credential Grab for 2026-09-18

Sep 18, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for editor backups and copies of .env files (.env~, .env1, .env_copy, .envrc). Scanners try these because a renamed copy often escapes the web server rule that blocks .env itself.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

Belgium	8	27.6%
United States	8	27.6%
Singapore	3	10.3%
Lithuania	3	10.3%
Taiwan	2	6.9%
Germany	1	3.4%
South Africa	1	3.4%
Brazil	1	3.4%
Romania	1	3.4%
Ukraine	1	3.4%

IP Address : ASN : City/Provider

213.209.159.133 : AS208137 Feo Prest SRL : Taiwan
34.14.83.108 : AS396982 Google LLC : Brussels
34.143.138.210 : AS396982 Google LLC : Singapore
34.143.238.151 : AS396982 Google LLC : Singapore
34.16.46.254 : AS396982 Google LLC : Council Bluffs
34.168.114.44 : AS396982 Google LLC : The Dalles
34.169.236.252 : AS396982 Google LLC : The Dalles
34.169.89.137 : AS396982 Google LLC : The Dalles
34.172.104.89 : AS396982 Google LLC : Council Bluffs
34.173.29.122 : AS396982 Google LLC : Council Bluffs
34.173.76.35 : AS396982 Google LLC : Council Bluffs
34.173.92.71 : AS396982 Google LLC : Council Bluffs
34.21.186.146 : AS396982 Google LLC : Singapore
34.32.35.5 : AS396982 Google LLC : Berlin
34.35.153.146 : AS396982 Google LLC : Johannesburg
34.39.204.181 : AS396982 Google LLC : São Paulo
34.52.133.111 : AS396982 Google LLC : Brussels
34.62.116.145 : AS396982 Google LLC : Brussels
34.77.137.207 : AS396982 Google LLC : Brussels
34.77.29.252 : AS396982 Google LLC : Brussels
34.79.176.214 : AS396982 Google LLC : Brussels
34.80.169.214 : AS396982 Google LLC : Taipei
35.240.58.49 : AS396982 Google LLC : Brussels
35.241.202.92 : AS396982 Google LLC : Brussels
45.138.12.26 : unknown : Lithuania
45.138.12.28 : unknown : Lithuania
45.138.12.30 : unknown : Lithuania
80.94.95.211 : AS204428 SS-Net : Romania
91.239.78.39 : AS6698 Virtual Systems LLC : Kyiv

Share on: