The most wanted files
Bots' most wanted file: /.env
Asked for 4,585 times by 636 scanners across 2,484 sites. They looked for .env in 556 different places.
Sunday, Oct 25, 2026 (UTC) · see the latest
4,417
files hunted
▼ -43% vs the day before
556
.env spots
▼ -69% vs the day before
4,585
asks for #1
Every edition: files hunted
How I measure
Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.
The top 20
Movement is against the day before.
| # | File | Requests | Scanners | Sites | Move |
|---|---|---|---|---|---|
| 1 | /.env | 4,585 | 636 | 2,484 | – |
| 2 | /.git/config | 3,189 | 1,024 | 2,032 | – |
| 3 | /.env.local | 2,671 | 560 | 1,769 | ▲1 |
| 4 | /.env.production | 2,643 | 562 | 1,801 | ▲1 |
| 5 | /.env.bak | 2,340 | 507 | 1,798 | ▲2 |
| 6 | /.env.backup | 2,275 | 504 | 1,760 | ▲2 |
| 7 | /.env.save | 2,162 | 477 | 1,704 | ▲3 |
| 8 | /download.php | 2,145 | 1,654 | 1 | ▼5 |
| 9 | /.env.old | 2,091 | 497 | 1,672 | ▲2 |
| 10 | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 2,091 | 8 | 273 | NEW |
| 11 | /.env.test | 2,055 | 439 | 1,663 | ▲2 |
| 12 | /_profiler/phpinfo | 2,053 | 352 | 1,576 | ▼6 |
| 13 | /.env.dist | 1,884 | 404 | 1,576 | ▲4 |
| 14 | /.env.sample | 1,859 | 395 | 1,567 | ▲4 |
| 15 | /api/.env | 1,689 | 436 | 1,470 | ▲8 |
| 16 | /.env.development | 1,676 | 472 | 1,384 | ▼7 |
| 17 | /service-account.json | 1,628 | 446 | 1,434 | ▲10 |
| 18 | /credentials.json | 1,624 | 446 | 1,432 | ▲8 |
| 19 | /.env.prod | 1,620 | 430 | 1,430 | ▼7 |
| 20 | /app/.env | 1,612 | 432 | 1,430 | ▲5 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
The AI Key Heist · Oct 27
Bots went hunting for AI keys 3,362 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 27
71% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.