// Security scanners
The painted mark for Security scanners
Placeholder: mark still to be painted

Security scanners

Programs that sweep the whole internet asking every site for files that are often left open by mistake on other kinds of sites: password files such as .env, WordPress login pages, admin panels. Some are run by researchers and security companies, some by people looking for weak sites to break into.

This site is plain pages with no login, database or admin area, so they find nothing here. Any visit asking for one of those addresses is counted here, whatever name it gives.

What they are after is passwords and keys: on a careless site those files hold the logins for a database, a cloud account or the server itself. With them someone can take a server over to send spam or mine cryptocurrency, copy its data, or run up bills on its owner's cloud account. The programs ask thousands of sites an hour, hoping one in a few thousand has left a file out.

In the key they are split by what they asked for:

  • Passwords and keys: .env files, cloud and SSH keys, saved logins.
  • WordPress logins: the login and admin pages of WordPress, which runs a large share of the world's websites.
  • Code history: a site's .git folder, which can hold its whole source code, passwords included.
  • Database copies: backups and database dumps left on the server.
  • Server settings: files that describe how a server is built (Docker, Terraform, config files).
  • Admin and debug pages: control panels and developer pages that show a server's inner workings.
  • PHP files and uploads: often looking for back doors that earlier intruders left behind on other sites.
  • Other scanning: the rest, mostly visits from before 13 October 2026, when only the first folder of the address was noted (/static/.env was just “static”).

Why? A few are security companies mapping what is exposed on the internet and selling that picture. Most are automatic attempts to find a site with a door left open: a leaked password file, a WordPress login, an admin page. A site that is broken into can be resold, used to send spam, or added to a network of hijacked machines. New sites are found within seconds, because every new site’s security certificate is written into a public log (SANS).