Week two: more bots, and WordPress requests doubled

Last week we wrote about the first week of the sensor on digimasi.com: 1,744 requests from bots, two thirds of them looking for .env files. Now the second week is complete, from Monday 19 to Sunday 25 October. The number of requests is almost the same, but far more bots came, and what they look for is starting to shift.

The numbers

• 1,809 requests from 137 IP addresses, recorded from 19 October at 00:00 Jakarta time (UTC+7) to the end of 25 October.
• Those addresses are registered in 30 countries. That is where the servers are, not necessarily where the people are.
• The largest network sent about a third of the requests (612), but from 28 different addresses. Last week, almost half of all requests came from just 3 addresses.
• 16 requests carried a guessed username or password, sent to login pages that do not exist.

None of them succeeded. The files they asked for simply do not exist on our website, so every one of them got a "not found" page.

Compared with the first week

• Almost the same number of requests, half again as many addresses: from 1,744 to 1,809 requests, but IP addresses rose from 91 to 137. Each address sent about 13 requests on average, down from about 19.
• .env is still number one, but its share fell: from 1,141 (almost two thirds) to 936 requests, about half. The number of addresses looking for it actually grew, from 39 to 50.
• WordPress doubled: from 197 to 395 requests, and from 50 to 72 addresses.
• The .git folder doubled too: from 76 to 150 requests, and from 20 to 42 addresses. /.git/config is now the second most requested path (52 times, from 34 addresses).
• PHP files fell: from 198 to 112 requests.

So this week was not about busier bots, but about more of them. More addresses stopped by, and each sent fewer requests.

What they looked for

• Secret .env configuration files (936 requests, 50 addresses). Eight of the ten most requested paths are variations of .env: /.env (62), /.env.local (34), /.env.backup (30), /.env.production (28), /.env.development (26), /.env.old (26), /.env.example (25) and /.env.save (24). Bots guess the names developers commonly use for copies or other versions of that file.
• WordPress (395 requests, 72 addresses). Including /xmlrpc.php (28 requests from 21 addresses), a door often used to guess passwords. Our website does not use WordPress.
• The .git code history folder (150 requests, 42 addresses).
• PHP files (112 requests). Our website does not use PHP either.
• Other configuration files (100 requests).
• Cloud and server keys (55 requests, 20 addresses).
• Backup files (36 requests, 6 addresses). This category appeared for the first time this week: guessed names of archives and database dumps.
• Admin panels (24 requests) and framework-specific paths (1).

Worth noting: more spread out

Last week, one network (Virtualine Technologies) sent 846 requests from just 3 addresses, almost half of the total. This week that network fell to 325 requests from 5 addresses. The top spot is now Google LLC: 612 requests, but from 28 addresses. Then come TECHOFF SRV LIMITED (273 from 11 addresses), TC DATACENTER (185 from 8 addresses) and DigitalOcean (77 from 24 addresses). The network name is the owner of the address block, usually a server or cloud provider. Anyone who rents a server there can use it, so it does not mean the company itself sent the requests.

The countries are more even too. Germany is still on top (376 requests), but far below last week's 950. The Netherlands (347), the United States (270, from 30 addresses), Belgium (238) and Poland (185) follow, and Italy (100) and Japan (59) entered the top ten.

About the login guesses

There were 16 login guesses, the same as last week, but the two numbers cannot be compared directly. From this week we no longer count WordPress pingbacks as login guesses, because they carry web addresses, not a username and a password. So all 16 this week are real login attempts. As last week, none of them used a stock username such as "admin", so the username list in the weekly record is empty again.

Check your own website

You can check all of this yourself in five minutes, on your own website:

• Open yourdomain.com/.env in a browser. You should see "not found". If you see the file's contents instead, move the file out of the public folder right away, then change every password and key in it.
• Try the variations too: /.env.local, /.env.backup, /.env.production, /.env.example. Even an example file sometimes holds real keys.
• Open yourdomain.com/.git/config. That should also say "not found". If you see text, your .git folder can be opened by anyone, and your website's code history with it.
• Do not keep backup files (.zip, .sql, .tar.gz) in the website folder. Store them somewhere that cannot be reached from the internet.
• If you use WordPress: turn off xmlrpc.php if you do not need it, limit login attempts, and turn on two-step verification for admin accounts. This week 72 different addresses tried WordPress on our website, and we do not use WordPress at all.

About this data

We only observe. All the data comes from bots that came to digimasi.com on their own; we never scan other people's websites, and we do not show IP addresses here. Addresses that clearly attacked us are reported to AbuseIPDB. The full method is on the methodology page, and each week's numbers are on the weekly record page.

Data: Digimasi security research, weekly sensor records (https://doi.org/10.5281/zenodo.23655270).

We will keep recording and comparing the results week by week.