The most wanted files

Bots' most wanted file: /.env

Asked for 9,767 times by 1,100 scanners across 3,291 sites. They looked for .env in 830 different places.

Edition of Tuesday, Oct 13, 2026 (UTC) · see the latest · updated every 24 hours

Share on X

4,084

files hunted

▼ -35% vs the day before

830

.env spots

▼ -47% vs the day before

9,767

asks for #1

Most wanted requests

1 /.env 9,767 –

2 /.env.local 7,261 ▲3

3 /.env.example 7,095 ▲4

4 /.env.production 7,093 –

5 /.env.staging 6,875 ▲9

↳ Nothing there. They keep looking.

Every edition: files hunted

Oct 13 Nov 11

How we measure

Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the NiceTryBot edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.

The top 20

Movement is against the day before.

#	File	Requests	Scanners	Sites	Move
1	/.env	9,767	1,100	3,291	–
2	/.env.local	7,261	918	2,898	▲3
3	/.env.example	7,095	876	2,898	▲4
4	/.env.production	7,093	917	2,863	–
5	/.env.staging	6,875	864	2,846	▲9
6	/.env.development	6,839	874	2,845	▲11
7	/.env.prod	6,815	759	2,835	▲13
8	/.env.bak	6,778	920	2,842	–
9	/.env.dev	6,732	750	2,833	▲14
10	/.git/config	6,728	1,680	2,628	▼8
11	/.env.test	6,652	727	2,825	▲16
12	/.env.sample	6,600	829	2,802	▲23
13	/.env.dist	6,461	844	2,774	▲18
14	/.env.backup	6,339	920	2,774	▼5
15	/.env.old	6,048	914	2,696	▲7
16	/.env.save	5,749	912	2,631	▲5
17	/.env.swp	5,336	850	2,585	▲16
18	/phpinfo.php	4,951	783	2,572	▼15
19	/phpinfo	4,856	707	2,521	▼4
20	/info.php	4,661	777	2,520	▼14

Past editions

Nov 11 Nov 10 Nov 9 Nov 8 Nov 7 Nov 6 Nov 5 Nov 4 Nov 3 Nov 2 Nov 1 Oct 31 Oct 30 Oct 29 Oct 28 Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

More from the edge

Bot Weather · Nov 11

20% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

Fraud Desk · Nov 11

32,669 requests got turned away at the door.

The AI Key Heist · Nov 11

Bots went hunting for AI keys 789 times.

Bots are hunting for AI API keys. Here's whose they want most.

Cloud Landlords · Nov 11

81% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

Speedrun · Nov 11

New sites get scanned in 1,245 minutes.

How many minutes a brand-new website gets before the first scanner shows up.

Costume Party · Nov 11

57% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.

Want these bots off your site?

Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.

See how it works