Environment File Variant Credential Grab for 2026-09-20

Sep 20, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for editor backups and copies of .env files (.env~, .env1, .env_copy, .envrc). Scanners try these because a renamed copy often escapes the web server rule that blocks .env itself.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States	8	29.6%
Belgium	5	18.5%
Singapore	3	11.1%
Germany	2	7.4%
Taiwan	1	3.7%
Thailand	1	3.7%
South Africa	1	3.7%
Brazil	1	3.7%
South Korea	1	3.7%
Sweden	1	3.7%
The Netherlands	1	3.7%
Romania	1	3.7%
Ukraine	1	3.7%

IP Address : ASN : City/Provider

213.209.159.84 : AS208137 Feo Prest SRL : Taiwan
34.140.234.80 : AS396982 Google LLC : Brussels
34.141.125.156 : AS396982 Google LLC : Frankfurt am Main
34.143.138.210 : AS396982 Google LLC : Singapore
34.15.170.245 : AS396982 Google LLC : Bangkok
34.156.130.80 : AS396982 Google LLC : Brussels
34.156.85.54 : AS396982 Google LLC : Brussels
34.16.139.189 : AS396982 Google LLC : Las Vegas
34.16.62.37 : AS396982 Google LLC : Council Bluffs
34.171.80.90 : AS396982 Google LLC : Council Bluffs
34.21.185.17 : AS396982 Google LLC : Singapore
34.21.186.235 : AS396982 Google LLC : Singapore
34.21.62.0 : AS396982 Google LLC : Washington
34.24.135.198 : AS396982 Google LLC : North Charleston
34.32.112.38 : AS396982 Google LLC : Berlin
34.35.103.165 : AS396982 Google LLC : Johannesburg
34.39.242.214 : AS396982 Google LLC : São Paulo
34.44.236.95 : AS396982 Google LLC : Council Bluffs
34.46.114.222 : AS396982 Google LLC : Council Bluffs
34.50.49.106 : AS396982 Google LLC : Seoul
34.51.131.94 : AS396982 Google LLC : Stockholm
34.56.177.125 : AS396982 Google LLC : Council Bluffs
34.78.136.180 : AS396982 Google LLC : Brussels
34.90.185.172 : AS396982 Google LLC : Groningen
35.240.58.49 : AS396982 Google LLC : Brussels
80.94.95.211 : AS204428 SS-Net : Romania
91.239.78.39 : AS6698 Virtual Systems LLC : Kyiv

Share on: