Environment File Variant Credential Grab for 2026-10-13

Oct 13, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for editor backups and copies of .env files (.env~, .env1, .env_copy, .envrc). Scanners try these because a renamed copy often escapes the web server rule that blocks .env itself.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

Belgium	6	22.2%
The Netherlands	4	14.8%
Japan	4	14.8%
United States	2	7.4%
Germany	2	7.4%
France	1	3.7%
Taiwan	1	3.7%
Brazil	1	3.7%
India	1	3.7%
Argentina	1	3.7%
Lithuania	1	3.7%
Georgia	1	3.7%
Romania	1	3.7%
Bulgaria	1	3.7%

IP Address : ASN : City/Provider

185.177.72.23 : AS211590 Bucklog SARL : France
213.209.159.133 : AS208137 Feo Prest SRL : Taiwan
34.106.33.201 : AS396982 Google LLC : Salt Lake City
34.140.234.80 : AS396982 Google LLC : Brussels
34.156.22.151 : AS396982 Google LLC : Brussels
34.39.255.30 : AS396982 Google LLC : São Paulo
34.4.25.87 : AS15169 Google LLC : New Delhi
34.62.25.61 : AS396982 Google LLC : Brussels
34.78.213.249 : AS396982 Google LLC : Brussels
34.89.236.91 : AS396982 Google LLC : Frankfurt am Main
34.90.247.220 : AS396982 Google LLC : Groningen
34.95.226.207 : AS396982 Google LLC : Argentina
35.187.203.244 : AS396982 Google LLC : Tokyo
35.189.150.144 : AS396982 Google LLC : Tokyo
35.189.196.57 : AS396982 Google LLC : Brussels
35.197.15.233 : AS396982 Google LLC : The Dalles
35.213.56.119 : AS15169 Google LLC : Tokyo
35.213.7.234 : AS15169 Google LLC : Tokyo
35.233.99.27 : AS396982 Google LLC : Brussels
45.138.12.28 : unknown : Lithuania
45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam
45.153.34.43 : AS197170 TechTies Inc. : Amsterdam
45.156.87.16 : AS197170 TechTies Inc. : Amsterdam
77.91.122.15 : AS201814 MEVSPACE sp. z o.o. : Georgia
80.94.95.211 : AS204428 SS-Net : Romania
93.123.109.228 : AS48090 Techoff Srv Limited : Bulgaria
93.152.221.34 : AS197170 TechTies Inc. : Frankfurt am Main

Share on: