NiceTryBot REAL HUMANS ONLY

The AI key heist

Bots went hunting for AI keys 1,316 times.

Most wanted: MCP & agent configs keys. They checked 105 hiding spots, from /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp to /sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a3211316-66e8-4aad-a3af-9090044999cd/waiting-room/CISoqnFgXyu5hdjR7FKKtvLjTXMcPsjvIJF9lmafJ6SAz7PC/heartbeat.

Edition of Monday, Nov 2, 2026 (UTC) · see the latest · updated every 24 hours

Share on X

1,316

AI key hunts

▼ -29% vs the day before

460

hunters

▲ +116% vs the day before

105

hiding spots

▼ -3.7% vs the day before

0.3%

of all probes

Whose keys they want requests
MCP & agent configs 575
Google Gemini 309
Anthropic 263
OpenAI 95
xAI 73
↳ Keep your keys out of your web root.

Every edition: AI key hunts

Oct 13 Nov 11

How we measure

Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the NiceTryBot edge during the UTC day.

Where they looked

The paths scanners tried, most-requested first.

Path Provider Requests Scanners
/img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp Google Gemini 303 253
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a3211316-66e8-4aad-a3af-9090044999cd/waiting-room/CISoqnFgXyu5hdjR7FKKtvLjTXMcPsjvIJF9lmafJ6SAz7PC/heartbeat MCP & agent configs 134 93
/.claude/settings.json Anthropic 87 15
/.claude/settings.local.json Anthropic 87 15
/.env.anthropic Anthropic 86 14
/.cursor/mcp.json MCP & agent configs 86 14
/.env.openai OpenAI 86 14
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a3211316-66e8-4aad-a3af-9090044999cd/waiting-room/CISoqnFgXyu5hdjR7FKKtvLjTXMcPsjvIJF9lmafJ6SAz7PC MCP & agent configs 69 24
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a32136b5-c49d-4954-8b83-358e4f6bc8a5/waiting-room/KNn8RM6hhWRVvQjmcPBB2wv9y3sY3W33FNgybeKWCGSCISa9/heartbeat MCP & agent configs 50 36
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a320f1c0-f040-40ae-824e-471881335e90/waiting-room/d2H8oInwNZgsAKLy0sC0Vhd1fq2HBCf4j3xaI5gHSCALsJE0/heartbeat xAI 48 1
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a32136b5-c49d-4954-8b83-358e4f6bc8a5/waiting-room/KNn8RM6hhWRVvQjmcPBB2wv9y3sY3W33FNgybeKWCGSCISa9 MCP & agent configs 28 11
/.well-known/mcp/server-card.json MCP & agent configs 28 8
/.well-known/mcp MCP & agent configs 26 6
/mcp MCP & agent configs 25 13
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a320160b-1b9e-4d5c-86a4-7a988cbc4d23/waiting-room/cCEf4pjwQMCPpCZGk9SVPbzOY6ph2cEGJOPoFiSmhn1uC5Ao/heartbeat MCP & agent configs 15 10
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a32066ea-07b3-47e5-a0df-dfab6b83d652/waiting-room/TkHXY7z4H4KnQmCPGp5FsWSvYB3SEelH3gWZwc8RVXrA4FkW/heartbeat MCP & agent configs 14 9
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a320bdb4-e406-41e9-9ea9-6012290206b7/waiting-room/ETDOvz5cTnKuRuAPyvuLKJxiEUOmcPKaEfmBrkVeDZUoIQG3/heartbeat MCP & agent configs 13 2
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a320160b-1b9e-4d5c-86a4-7a988cbc4d23/waiting-room/cCEf4pjwQMCPpCZGk9SVPbzOY6ph2cEGJOPoFiSmhn1uC5Ao MCP & agent configs 7 3
/.well-known/mcp.json MCP & agent configs 7 5
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a32066ea-07b3-47e5-a0df-dfab6b83d652/waiting-room/TkHXY7z4H4KnQmCPGp5FsWSvYB3SEelH3gWZwc8RVXrA4FkW MCP & agent configs 7 3
/copilot/.workspace MCP & agent configs 5 3
/storage/photo_uploads/684/vdYhomso7Ar8i1SuLictWL4HtNPc6VpM9mcPmv9S.jpeg MCP & agent configs 4 3
/.well-known/mcp-server MCP & agent configs 4 3
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a3210e46-cb8e-41ad-8e32-e971d390bf0c/waiting-room/2WXs7bUFtcrDy8Dj9YbST8G2ALIbwMcPW4XZPPVRTRjlAApG/heartbeat MCP & agent configs 3 1
/storage/photo_uploads/336/F1ZyQi90tDo5tMcpXaD83cMaMfuOwzWBmUlt4ziF.jpeg MCP & agent configs 3 2

Past editions

Nov 11 Nov 10 Nov 9 Nov 8 Nov 7 Nov 6 Nov 5 Nov 4 Nov 3 Nov 2 Nov 1 Oct 31 Oct 30 Oct 29 Oct 28 Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

More from the edge

Bot Weather: 20% of yesterday's traffic was scanners.

Bot Weather · Nov 11

20% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

 Fraud Desk: 32,669 requests got turned away at the door.

Fraud Desk · Nov 11

32,669 requests got turned away at the door.

Login stuffing, failed logins, and who got turned away at the door.

 Most Wanted: Bots' most wanted file: /download.php

Most Wanted · Nov 11

Bots' most wanted file: /download.php

The files bots asked for most yesterday. It's usually your .env.

 Cloud Landlords: 81% of scanning came from rented servers.

Cloud Landlords · Nov 11

81% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

 Speedrun: New sites get scanned in 1,245 minutes.

Speedrun · Nov 11

New sites get scanned in 1,245 minutes.

How many minutes a brand-new website gets before the first scanner shows up.

 Costume Party: 57% of "browsers" were bots in costume.

Costume Party · Nov 11

57% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.

Want these bots off your site?

Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.

See how it works