The AI key heist
Bots went hunting for AI keys 561 times.
Most wanted: Google Gemini keys. They checked 35 hiding spots, from /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp to /.well-known/mcp/server-card.json.
Edition of Monday, Nov 9, 2026 (UTC) · see the latest · updated every 24 hours
561
AI key hunts
▼ -2.9% vs the day before
292
hunters
▼ -5.2% vs the day before
35
hiding spots
▼ -5.4% vs the day before
0.7%
of all probes
Every edition: AI key hunts
How we measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the NiceTryBot edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp | Google Gemini | 271 | 224 |
| /.well-known/mcp/server-card.json | MCP & agent configs | 67 | 6 |
| /.well-known/mcp | MCP & agent configs | 66 | 5 |
| /copilot/.workspace | MCP & agent configs | 36 | 25 |
| /storage/photo_uploads/584/PNHYH6oL4Ckkl2VnZ6QyTPP9Tt53KmcPAo2p1L2D.jpeg | MCP & agent configs | 10 | 9 |
| /.cursor/mcp.json | MCP & agent configs | 10 | 8 |
| /.mcp.json | MCP & agent configs | 7 | 3 |
| /AGENTS.md | MCP & agent configs | 7 | 3 |
| /.continue/config.json | MCP & agent configs | 6 | 3 |
| /CLAUDE.md | Anthropic | 6 | 3 |
| /.claude/.credentials.json | Anthropic | 6 | 3 |
| /.amazonq/mcp.json | MCP & agent configs | 6 | 3 |
| /.env.anthropic | Anthropic | 5 | 5 |
| /.vscode/mcp.json | MCP & agent configs | 5 | 3 |
| /.claude/settings.json | Anthropic | 5 | 5 |
| /.claude/settings.local.json | Anthropic | 5 | 5 |
| /.env.openai | OpenAI | 5 | 5 |
| /wp-content/uploads/2021/08/BGFrsQuMCP6rx4OLIddj18JPZjehTabFL2dtSGlL_1200x650.jpeg | MCP & agent configs | 5 | 5 |
| /wp-content/uploads/2021/05/PS9DxaIBjr0K2b46lw4rhdP2dSqa7bnAO4Wm7KJR_1200x650.jpeg | xAI | 5 | 5 |
| /mcp | MCP & agent configs | 4 | 4 |
| /storage/photo_uploads/684/vdYhomso7Ar8i1SuLictWL4HtNPc6VpM9mcPmv9S.jpeg | MCP & agent configs | 4 | 1 |
| /wp-content/uploads/2022/06/uAkUNx4nm3BsXUKwjcei7MCpu47XTfbe8CTFYTeM_1200x650.jpg | MCP & agent configs | 2 | 1 |
| /storage/photo_uploads/646/ObrClcXAiYpz5jtI42SNAlJOFZmIK10mfiHieHVN.jpeg | xAI | 2 | 1 |
| /storage/photo_uploads/760/MTGQ2LomcpNQ6mYUceWu8GL34YQbzAaaNPZfqy4J.jpeg | MCP & agent configs | 2 | 1 |
| /.well-known/mcp.json | MCP & agent configs | 2 | 2 |
Past editions
More from the edge
Bot Weather · Nov 11
20% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Nov 11
32,669 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Nov 11
Bots' most wanted file: /download.php
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Nov 11
81% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Nov 11
New sites get scanned in 1,245 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Nov 11
57% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.
Want these bots off your site?
Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.
See how it works