#

Tag Archive

Tag: credential scanning

Articles

1 story

Security

Credential Scanners Are Wearing Crawler Costumes

71.9 percent of traffic claiming to be Googlebot was hunting for .env files. Of 13,670 credential probes wearing a named crawler user agent, zero came from a verified vendor IP.

Dominic Plouffe · 7 min Aug 14, 2026

Dark terminal graphic. A log line shows 101.47.155.116 requesting /.git/config while claiming to be Googlebot, flagged as not in any Google-published IP range, 6092 probes from this address. Three statistics: 71.9 percent of traffic claiming to be Googlebot was probing for secrets, 13,670 credential probes wearing a named crawler user agent, and zero of them came from a verified vendor IP address.