The most wanted files
Bots' most wanted file: /download.php
Asked for 4,658 times by 1,723 scanners across 1 sites. They looked for .env in 334 different places.
Edition of Sunday, Nov 8, 2026 (UTC) · see the latest · updated every 24 hours
2,577
files hunted
▼ -13% vs the day before
334
.env spots
▲ +3.1% vs the day before
4,658
asks for #1
Every edition: files hunted
How we measure
Requests for paths that only scanners ask for, ranked by how many times they were asked for during the UTC day, across every site behind the NiceTryBot edge. Movement compares with the day before; NEW means the path wasn't in the previous day's top 50.
The top 20
Movement is against the day before.
| # | File | Requests | Scanners | Sites | Move |
|---|---|---|---|---|---|
| 1 | /download.php | 4,658 | 1,723 | 1 | – |
| 2 | /.git/config | 2,901 | 1,194 | 2,296 | ▲3 |
| 3 | /.git/HEAD | 2,648 | 1,040 | 2,203 | NEW |
| 4 | /wp-admin/install.php | 691 | 507 | 56 | ▼1 |
| 5 | /wp-login.php | 495 | 228 | 104 | ▲14 |
| 6 | /product-info.php | 332 | 320 | 1 | ▲1 |
| 7 | /wp-cron.php | 322 | 2 | 3 | ▼3 |
| 8 | /.env.production | 319 | 167 | 261 | ▲3 |
| 9 | /.env | 309 | 176 | 268 | ▼1 |
| 10 | /.env.local | 286 | 162 | 257 | – |
| 11 | /.env.backup | 279 | 156 | 251 | ▼2 |
| 12 | /.env.prod | 276 | 155 | 250 | ▲9 |
| 13 | /.env.bak | 275 | 154 | 250 | – |
| 14 | /.env.old | 274 | 153 | 249 | ▼2 |
| 15 | /.env.save | 270 | 149 | 244 | ▼1 |
| 16 | /.env.example | 261 | 141 | 238 | ▲8 |
| 17 | /.env.dev | 259 | 137 | 237 | ▼2 |
| 18 | /.env.staging | 252 | 129 | 232 | ▼2 |
| 19 | /api/.env | 250 | 145 | 233 | ▲9 |
| 20 | /.env.development | 249 | 127 | 229 | – |
Past editions
More from the edge
Bot Weather · Nov 11
20% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Nov 11
32,669 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
The AI Key Heist · Nov 11
Bots went hunting for AI keys 789 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Nov 11
81% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Nov 11
New sites get scanned in 1,245 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Nov 11
57% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.
Want these bots off your site?
Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.
See how it works