Change in ENV Crawler Tags as Bots Continue to Target Environment Files

Summary: On April 25, 2023, GreyNoise reclassified environment file crawlers from unknown intent to malicious intent, a change that reclassifies over 11,000 IPs as malicious. Environment files are hidden dotfiles that typically hold authentication keys, passwords, and connection paths, and GreyNoise says organizations often do not know they are exposing them publicly.
What you should know: More than 11,000 IPs now carry a malicious tag, and any organization blocking on that tag will see more blocked traffic - but the exposure itself is the real problem, since anyone who retrieves a public .env file can reach the credentials inside it.

Read the original at GreyNoise Blog ↗