Environment File Variant Credential Grab for 2026-10-23

Oct 23, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for editor backups and copies of .env files (.env~, .env1, .env_copy, .envrc). Scanners try these because a renamed copy often escapes the web server rule that blocks .env itself.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

France: 14Belgium: 8The Netherlands: 6United States: 6Singapore: 3Poland: 3Lithuania: 3Germany: 2Japan: 2Iran: 2Bulgaria: 2Sweden: 1Indonesia: 1United Kingdom: 1Canada: 1Spain: 1Taiwan: 1Brazil: 1Ireland: 1Russia: 1Italy: 1
France1423.0%
Belgium813.1%
The Netherlands69.8%
United States69.8%
Singapore34.9%
Poland34.9%
Lithuania34.9%
Germany23.3%
Japan23.3%
Iran23.3%
Bulgaria23.3%
Sweden11.6%
Indonesia11.6%
United Kingdom11.6%
Canada11.6%
Spain11.6%
Taiwan11.6%
Brazil11.6%
Ireland11.6%
Russia11.6%
Italy11.6%

IP Address : ASN : City/Provider

  • 13.51.206.230 : AS16509 Amazon.com, Inc. : Stockholm

  • 130.12.180.117 : AS202412 Omegatech LTD : Amsterdam

  • 130.211.85.163 : AS396982 Google LLC : Brussels

  • 134.209.246.237 : AS14061 DigitalOcean, LLC : Frankfurt am Main

  • 136.110.106.71 : AS396982 Google LLC : Tokyo

  • 138.199.60.183 : AS212238 Datacamp Limited : Singapore

  • 146.70.144.51 : AS9009 M247 Europe SRL : Warsaw

  • 152.42.249.165 : AS14061 DigitalOcean, LLC : Singapore

  • 157.15.40.91 : AS139952 PT Trisari Data Indonusa : Madiun

  • 167.99.163.166 : AS14061 DigitalOcean, LLC : Santa Clara

  • 176.65.132.217 : AS197170 TechTies Inc. : Amsterdam

  • 18.141.215.168 : AS16509 Amazon.com, Inc. : Singapore

  • 18.170.220.57 : AS16509 Amazon.com, Inc. : City of London

  • 185.177.72.10 : AS211590 Bucklog SARL : France

  • 185.177.72.106 : AS211590 Bucklog SARL : France

  • 185.177.72.111 : AS211590 Bucklog SARL : France

  • 185.177.72.115 : AS211590 Bucklog SARL : France

  • 185.177.72.12 : AS211590 Bucklog SARL : France

  • 185.177.72.13 : AS211590 Bucklog SARL : France

  • 185.177.72.179 : AS211590 Bucklog SARL : France

  • 185.177.72.210 : AS211590 Bucklog SARL : France

  • 185.177.72.22 : AS211590 Bucklog SARL : France

  • 185.177.72.23 : AS211590 Bucklog SARL : France

  • 185.177.72.236 : AS211590 Bucklog SARL : France

  • 185.177.72.30 : AS211590 Bucklog SARL : France

  • 185.177.72.51 : AS211590 Bucklog SARL : France

  • 185.177.72.56 : AS211590 Bucklog SARL : France

  • 185.93.89.60 : AS213790 Limited Network LTD : Iran

  • 20.118.218.222 : AS8075 Microsoft Corporation : Des Moines

  • 20.151.202.132 : AS8075 Microsoft Corporation : Toronto

  • 207.175.220.59 : AS396982 Google LLC : Brussels

  • 3.76.43.120 : AS16509 Amazon.com, Inc. : Frankfurt am Main

  • 34.153.195.144 : AS396982 Google LLC : Tokyo

  • 34.175.101.46 : AS396982 Google LLC : Madrid

  • 34.182.244.125 : AS396982 Google LLC : Washington

  • 34.22.126.178 : AS396982 Google LLC : Brussels

  • 34.22.221.204 : AS396982 Google LLC : Brussels

  • 34.62.82.165 : AS396982 Google LLC : Brussels

  • 34.7.123.241 : AS396982 Google LLC : Groningen

  • 34.81.18.95 : AS396982 Google LLC : Taipei

  • 35.195.107.252 : AS396982 Google LLC : Brussels

  • 35.198.31.220 : AS396982 Google LLC : São Paulo

  • 35.205.169.234 : AS396982 Google LLC : Brussels

  • 35.241.178.74 : AS396982 Google LLC : Brussels

  • 45.128.38.237 : AS9009 M247 Europe SRL : Warsaw

  • 45.128.38.243 : AS9009 M247 Europe SRL : Warsaw

  • 45.138.12.27 : unknown : Lithuania

  • 45.138.12.52 : unknown : Lithuania

  • 45.138.12.68 : unknown : Lithuania

  • 45.148.10.21 : AS48090 Techoff Srv Limited : Amsterdam

  • 45.156.87.246 : AS197170 TechTies Inc. : Amsterdam

  • 52.48.247.166 : AS16509 Amazon.com, Inc. : Dublin

  • 54.183.110.153 : AS16509 Amazon.com, Inc. : San Jose

  • 62.233.51.166 : unknown : Chicago

  • 62.60.131.204 : AS208137 Feo Prest SRL : Tehran

  • 79.124.49.10 : AS50360 Tamatiya EOOD : Bulgaria

  • 85.11.167.138 : AS197170 TechTies Inc. : Amsterdam

  • 91.215.85.24 : AS200593 Prospero Ooo : Russia

  • 91.219.212.220 : AS9009 M247 Europe SRL : Los Angeles

  • 93.123.109.246 : AS48090 Techoff Srv Limited : Bulgaria

  • 95.214.24.52 : AS215873 Tod’s S.p.A. : Sant’Elpidio a Mare

Share on: