Security research

What bots try on our own website

Statistics from the Digimasi sensor, updated daily. Every number below is a request to digimasi.com, our own website, for a file it never had. Other websites on the internet get this kind of traffic too, but the numbers on this page are from ours only.

Updated 17 October 2026 · Period 12 October 2026 – 17 October 2026. The sensor keeps the last 90 days.

Attack statistics

bot requests
1,101
source addresses
70
countries
28
of requests were login guesses
1.2%

Bot requests per day

Bot requests per day Over 6 days the sensor recorded 1,101 bot requests, about 184 a day. The busiest day was 17 October 2026, with 595 requests. 12 October 2026: 3213 October 2026: 5214 October 2026: 11515 October 2026: 22316 October 2026: 8417 October 2026: 595

Over 6 days the sensor recorded 1,101 bot requests, about 184 a day. The busiest day was 17 October 2026, with 595 requests.

Most requested paths

None of these files exist on digimasi.com. Bots ask for them anyway, because on some websites they do.

  1. /.envLooking for leaked passwords and keys in a .env file51
  2. /.env.localLooking for leaked passwords and keys in a .env file27
  3. /.env.backupLooking for leaked passwords and keys in a .env file24
  4. /.env.productionLooking for leaked passwords and keys in a .env file23
  5. /.env.bakLooking for leaked passwords and keys in a .env file21
  6. /.env.saveLooking for leaked passwords and keys in a .env file20
  7. /wp-login.phpGuessing WordPress admin passwords20
  8. /.env.devLooking for leaked passwords and keys in a .env file19
  9. /.env.stagingLooking for leaked passwords and keys in a .env file19
  10. /.env.oldLooking for leaked passwords and keys in a .env file18
  11. /.env.developmentLooking for leaked passwords and keys in a .env file17
  12. /.env.prodLooking for leaked passwords and keys in a .env file16
  13. /.env.liveLooking for leaked passwords and keys in a .env file15
  14. /.git/HEADTrying to download the site's code history, which can hold passwords15
  15. /xmlrpc.phpGuessing many WordPress passwords at once through XML-RPC14

What they looked for

  1. Secret configuration files (.env)697
  2. WordPress172
  3. PHP files97
  4. Code history folder (.git)47
  5. Other configuration files40
  6. Cloud and server keys27
  7. Framework-specific paths13
  8. Admin panels8

Source countries

  1. Germany483
  2. Netherlands116
  3. Belgium88
  4. United States82
  5. Poland73
  6. Finland57
  7. Chile40
  8. China31
  9. Singapore25
  10. Italy21

Source networks

  1. Virtualine Technologies AS202412407
  2. Google LLC AS396982277
  3. TC DATACENTER LIMITED MANAGED IP SPACE AS21878581
  4. DigitalOcean, LLC AS1406157
  5. TECHOFF SRV LIMITED AS4809049
  6. Feo Prest SRL AS20813737
  7. Aliyun Computing Co.LTD AS3796331
  8. Colocatel Datacenter AS21343826
  9. Secure Internet Hong Kong Operations AS19945726
  10. Microsoft Corporation AS807520

HTTP methods

  1. GET1,054
  2. POST26
  3. HEAD21

Countries and networks are where the sending servers are, not necessarily where the people behind them are. We do not show IP addresses, passwords, full user agents or request bodies, and we leave out usernames shaped like an email. Methodology · Weekly record →

What this means for your website

Keep secret files out of the web folder

A .env file, a backup or a database dump must never sit in a folder the website serves. Bots ask for these first.

Update WordPress and its plugins

Bots look for known weak spots in old versions. Turn on automatic updates and remove plugins you do not use.

Protect the login page

Use strong, different passwords for every account, turn on two-step login, limit login attempts, and switch off XML-RPC if you do not need it.

Check your security headers

Headers like Content-Security-Policy make many attacks harder. Our free check shows which ones your website is missing.

See your website from the outside

Run the free Security Headers Check, or ask us for a pentest: we test your website the way a real attacker would, with your written permission.

Run the free checkSee the pentest service