Environment File Variant Credential Grab for 2026-10-21
Last Updated: 00:00 UTC
Requests for editor backups and copies of .env files (.env~, .env1, .env_copy, .envrc). Scanners try these because a renamed copy often escapes the web server rule that blocks .env itself.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files
Observed URIs
Attackers by Country
| United States | 6 | 15.4% |
| France | 5 | 12.8% |
| The Netherlands | 4 | 10.3% |
| Singapore | 2 | 5.1% |
| Switzerland | 2 | 5.1% |
| Japan | 2 | 5.1% |
| Germany | 2 | 5.1% |
| South Africa | 2 | 5.1% |
| Canada | 2 | 5.1% |
| Philippines | 1 | 2.6% |
| Bangladesh | 1 | 2.6% |
| Bulgaria | 1 | 2.6% |
| South Korea | 1 | 2.6% |
| Italy | 1 | 2.6% |
| Taiwan | 1 | 2.6% |
| Belgium | 1 | 2.6% |
| Lithuania | 1 | 2.6% |
| India | 1 | 2.6% |
| Brazil | 1 | 2.6% |
| United Kingdom | 1 | 2.6% |
| Czechia | 1 | 2.6% |
IP Address : ASN : City/Provider
-
103.150.221.142 : AS140599 COMFAC CORPORATION : Pampanga
-
103.41.245.137 : AS63844 One Net Communication Ltd : Bangladesh
-
13.250.5.64 : AS16509 Amazon.com, Inc. : Singapore
-
130.12.180.117 : AS202412 Omegatech LTD : Amsterdam
-
136.66.105.27 : AS396982 Google LLC : The Dalles
-
138.199.15.72 : AS60068 Datacamp Limited : Marseille
-
152.42.249.165 : AS14061 DigitalOcean, LLC : Singapore
-
179.43.149.114 : AS51852 Private Layer INC : Rümlang
-
185.177.72.23 : AS211590 Bucklog SARL : France
-
185.177.72.29 : AS211590 Bucklog SARL : France
-
185.177.72.66 : AS211590 Bucklog SARL : France
-
195.178.110.199 : AS48090 Techoff Srv Limited : Bulgaria
-
23.144.160.164 : AS32727 SB Professional Services : United States
-
3.34.47.183 : AS16509 Amazon.com, Inc. : Incheon
-
34.146.205.230 : AS396982 Google LLC : Tokyo
-
34.146.232.153 : AS396982 Google LLC : Tokyo
-
34.154.251.168 : AS396982 Google LLC : Milan
-
34.32.126.68 : AS396982 Google LLC : Berlin
-
34.35.133.208 : AS396982 Google LLC : Johannesburg
-
34.35.157.248 : AS396982 Google LLC : Johannesburg
-
34.40.50.130 : AS396982 Google LLC : Frankfurt am Main
-
34.63.76.199 : AS396982 Google LLC : Council Bluffs
-
34.65.170.165 : AS396982 Google LLC : Zurich
-
35.183.142.10 : AS16509 Amazon.com, Inc. : Montreal
-
35.183.204.10 : AS16509 Amazon.com, Inc. : Montreal
-
35.194.192.3 : AS396982 Google LLC : Taipei
-
35.204.233.96 : AS396982 Google LLC : Groningen
-
35.240.61.234 : AS396982 Google LLC : Brussels
-
45.138.12.68 : unknown : Lithuania
-
45.148.10.244 : AS48090 Techoff Srv Limited : Amsterdam
-
45.148.10.4 : AS48090 Techoff Srv Limited : Amsterdam
-
5.8.35.76 : AS199524 G-Core Labs S.A. : Navi Mumbai
-
51.195.91.135 : AS16276 OVH SAS : France
-
52.203.104.69 : AS14618 Amazon.com, Inc. : Ashburn
-
54.82.73.243 : AS14618 Amazon.com, Inc. : Ashburn
-
54.94.34.121 : AS16509 Amazon.com, Inc. : São Paulo
-
78.153.140.224 : AS202306 Hostglobal.plus Ltd : City of London
-
83.147.52.37 : AS399486 12651980 CANADA INC. : Edison
-
91.199.147.230 : AS62212 SmartApe OU : Veselí nad Lužnicí