The most wanted files
Bots' most wanted file: /.env
Asked for 14 times by 10 scanners across 3 sites. They looked for .env in 66 different places.
Wednesday, Oct 7, 2026 (UTC) · see the latest
191
files hunted
66
.env spots
14
asks for #1
How I measure
Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.
The top 20
Movement is against the day before.
| # | File | Requests | Scanners | Sites | Move |
|---|---|---|---|---|---|
| 1 | /.env | 14 | 10 | 3 | |
| 2 | /api/graphql | 4 | 4 | 1 | |
| 3 | /cgi-bin/php | 4 | 2 | 1 | |
| 4 | /../.env | 4 | 1 | 1 | |
| 5 | /.env.backup | 4 | 3 | 1 | |
| 6 | /.env.bak | 4 | 3 | 1 | |
| 7 | /.env.old | 4 | 3 | 1 | |
| 8 | /.env.production | 4 | 3 | 1 | |
| 9 | /.env.save | 4 | 3 | 1 | |
| 10 | /.env.txt | 4 | 2 | 2 | |
| 11 | /.git/config | 4 | 4 | 1 | |
| 12 | /graphql | 4 | 4 | 1 | |
| 13 | /_ignition/execute-solution | 4 | 1 | 1 | |
| 14 | /index.php | 4 | 2 | 1 | |
| 15 | /info.php | 4 | 3 | 1 | |
| 16 | /_profiler/phpinfo | 4 | 1 | 1 | |
| 17 | /userfiles | 4 | 1 | 1 | |
| 18 | /admin/.env | 3 | 2 | 1 | |
| 19 | /api/.env | 3 | 2 | 1 | |
| 20 | /app/.env | 3 | 2 | 1 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
The AI Key Heist · Oct 27
Bots went hunting for AI keys 3,362 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 27
71% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.