# 113SEC Tehdit Araştırma / Threat Research — "Araç A / Tool A": Google Cloud kaynaklı gizli dosya tarama aracının denediği yollar / paths tried by the tool
# kaynak / source: AWS WAF kayıtları / logs, 5 Ekim – 2 Kasım 2026 / 5 October – 2 November 2026; 42 IP
# kendi sitelerimizden toplanan 21 bağlantı listeden çıkarıldı / 21 links collected from our own sites were removed
# biçim / format: ilk_görülme_tarihi_UTC / first_seen_UTC<TAB>yol / path<TAB>IP sayısı / IP count
2026-10-05	/.amplifyrc	42
2026-10-05	/.aws/.env	42
2026-10-05	/.aws/config	42
2026-10-05	/.aws/credentials	42
2026-10-05	/.aws/credentials.bak	42
2026-10-05	/.boto	42
2026-10-05	/.claude/settings.json	42
2026-10-05	/.claude/settings.local.json	42
2026-10-05	/.docker/.env	42
2026-10-05	/.docker/config.json	42
2026-10-05	/.docker/laravel/app/.env	42
2026-10-05	/.env	42
2026-10-05	/.env-example	42
2026-10-05	/.env-sample	42
2026-10-05	/.env.anthropic	42
2026-10-05	/.env.aws	42
2026-10-05	/.env.backup	42
2026-10-05	/.env.bak	42
2026-10-05	/.env.dev	42
2026-10-05	/.env.development	42
2026-10-05	/.env.dist	42
2026-10-05	/.env.docker	42
2026-10-05	/.env.example	42
2026-10-05	/.env.live	42
2026-10-05	/.env.local	42
2026-10-05	/.env.old	42
2026-10-05	/.env.openai	42
2026-10-05	/.env.php	42
2026-10-05	/.env.prod	42
2026-10-05	/.env.production	42
2026-10-05	/.env.sample	42
2026-10-05	/.env.save	42
2026-10-05	/.env.staging	42
2026-10-05	/.env.swp	42
2026-10-05	/.env.test	42
2026-10-05	/.env.testing	42
2026-10-05	/.env~	42
2026-10-05	/.git-credentials	42
2026-10-05	/.git/config	42
2026-10-05	/.git/index	42
2026-10-05	/.git/logs/HEAD	42
2026-10-05	/.git/logs/refs/heads/main	42
2026-10-05	/.github/workflows/deploy.yml	42
2026-10-05	/.gitlab-ci.yml	42
2026-10-05	/.gitmodules	42
2026-10-05	/.npmrc	42
2026-10-05	/.s3cfg	42
2026-10-05	/Dockerfile	42
2026-10-05	/_profiler/phpinfo	42
2026-10-05	/admin/.env	42
2026-10-05	/api/.env	42
2026-10-05	/api/phpinfo.php	42
2026-10-05	/app.js	42
2026-10-05	/app/.env	42
2026-10-05	/application/.env	42
2026-10-05	/appsettings.Development.json	42
2026-10-05	/appsettings.Production.json	42
2026-10-05	/appsettings.json	42
2026-10-05	/auth.json	42
2026-10-05	/aws-exports.js	42
2026-10-05	/back/.env	42
2026-10-05	/backend/.env	42
2026-10-05	/backup/.env	42
2026-10-05	/cms/.env	42
2026-10-05	/composer.json	42
2026-10-05	/config.env	42
2026-10-05	/config.js	42
2026-10-05	/config.json	42
2026-10-05	/config.php	42
2026-10-05	/config.yaml	42
2026-10-05	/config/.env	42
2026-10-05	/config/aws.yml	42
2026-10-05	/config/config.js	42
2026-10-05	/core/.env	42
2026-10-05	/credentials	42
2026-10-05	/credentials.cfg	1
2026-10-05	/credentials.conf	1
2026-10-05	/credentials.ini	42
2026-10-05	/credentials.json	42
2026-10-05	/credentials.properties	1
2026-10-05	/credentials.yaml	1
2026-10-05	/database.sql	42
2026-10-05	/dev/.env	42
2026-10-05	/docker-compose.yml	42
2026-10-05	/env	42
2026-10-05	/env-config.js	42
2026-10-05	/env.js	42
2026-10-05	/env.txt	42
2026-10-05	/frontend/.env	42
2026-10-05	/index.js	42
2026-10-05	/info.php	42
2026-10-05	/laravel/.env	42
2026-10-05	/media/.env	42
2026-10-05	/new/.env	42
2026-10-05	/old/.env	42
2026-10-05	/phpinfo	42
2026-10-05	/phpinfo.php	42
2026-10-05	/production/.env	42
2026-10-05	/public/.env	42
2026-10-05	/runtime-config.js	42
2026-10-05	/secrets.json	42
2026-10-05	/secrets.toml	1
2026-10-05	/secrets.yaml	1
2026-10-05	/secrets.yml	1
2026-10-05	/sendgrid.env	42
2026-10-05	/server/.env	42
2026-10-05	/settings.json	42
2026-10-05	/src/.env	42
2026-10-05	/staging/.env	42
2026-10-05	/test/.env	42
2026-10-05	/v1/.env	42
2026-10-05	/v2/.env	42
2026-10-05	/vendor/composer/installed.json	42
2026-10-05	/web/.env	42
2026-10-05	/wp-config.php.bak	42
2026-10-05	/wp-content/debug.log	42
2026-10-05	/.env.facebook	1
2026-10-05	/.env.instagram	1
2026-10-05	/.env.linkedin	1
2026-10-05	/.env.twitter	1
2026-10-05	/facebook.json	1
2026-10-05	/linkedin.json	1
2026-10-05	/twitter.json	1
2026-10-05	/xero.json	1
2026-10-05	/.vault	1
2026-10-05	/.vault.json	1
2026-10-05	/.vault.yml	1
2026-10-05	/vault.properties	1
2026-10-05	/vault.toml	1
2026-10-05	/vault.yaml	1
2026-10-05	/vault.yml	1
2026-10-05	/.env.mistral	1
2026-10-05	/.github/workflows/docker.yml	1
2026-10-05	/.github/workflows/node.js.yml	1
2026-10-05	/.github/workflows/production.yml	1
2026-10-05	/.github/workflows/publish.yml	1
2026-10-05	/mistral.json	1
2026-10-05	/phpmyadmin/config.inc.php	1
2026-10-05	/pma/config.inc.php	1
2026-10-05	/analytics/.env	1
2026-10-05	/export/.env	1
2026-10-05	/import/.env	1
2026-10-05	/log/.env	1
2026-10-05	/metrics/.env	1
2026-10-05	/report/.env	1
2026-10-05	/reports/.env	1
2026-10-05	/stats/.env	1
2026-10-08	/.env.appsflyer	1
2026-10-08	/.env.branch	1
2026-10-08	/.env.ssm	1
2026-10-08	/app.config.js	39
2026-10-08	/appsflyer.json	1
2026-10-08	/branch.json	1
2026-10-08	/demo/.env	39
2026-10-08	/firebase-adminsdk.json	1
2026-10-08	/service-account-key.json	1
2026-10-08	/.ssh/id_ed25519	1
2026-10-08	/capacitor/.env	1
2026-10-08	/cordova/.env	1
2026-10-08	/electron/.env	1
2026-10-08	/flutter/.env	1
2026-10-08	/ionic/.env	1
2026-10-08	/vue-app/.env	1
2026-10-08	/.env.assemblyai	1
2026-10-08	/.env.claude	1
2026-10-08	/.env.elevenlabs	1
2026-10-08	/.env.stability	1
2026-10-08	/assemblyai.json	1
2026-10-08	/gemini.json	1
2026-10-08	/stability.json	1
2026-10-09	/.env.betterstack	1
2026-10-09	/.env.brevo	1
2026-10-09	/.env.uptimerobot	1
2026-10-09	/betterstack.json	1
2026-10-09	/brevo.json	1
2026-10-09	/uptimerobot.json	1
2026-10-09	/bak/.env	1
2026-10-09	/main/.env	1
2026-10-09	/master/.env	1
2026-10-09	/primary/.env	1
2026-10-09	/root/.env	1
2026-10-09	/secondary/.env	1
2026-10-09	/tmp/.env	1
2026-10-10	/.drone.yaml	1
2026-10-10	/.env.mailerlite	1
2026-10-10	/.forgejo/workflows/main.yaml	1
2026-10-10	/.forgejo/workflows/main.yml	1
2026-10-10	/.gitea/workflows/main.yaml	1
2026-10-10	/.woodpecker.yaml	1
2026-10-10	/mailerlite.json	1
2026-10-10	/.netlify/.env	1
2026-10-10	/.netlify/config.json	1
2026-10-10	/.vercel/.env	1
2026-10-10	/firebase-service-account.json	3
2026-10-10	/firebase/.env	1
2026-10-10	/firebase/config.json	1
2026-10-10	/railway.toml	1
2026-10-10	/app/backend/.env	2
2026-10-10	/app/frontend/.env	2
2026-10-10	/env.mjs	2
2026-10-10	/env.ts	2
2026-10-10	/site/config/.env	2
2026-10-10	/web/config/.env	2
2026-10-10	/www/config/.env	2
2026-10-10	/backend/config/.env	1
2026-10-10	/client/config/.env	1
2026-10-10	/frontend/config/.env	1
2026-10-10	/src/app/.env	1
2026-10-10	/src/backend/.env	1
2026-10-10	/src/client/.env	1
2026-10-10	/src/frontend/.env	1
2026-10-10	/src/server/.env	1
2026-10-11	/.claude/credentials	1
2026-10-11	/.claude/credentials.json	1
2026-10-11	/.git/HEAD	6
2026-10-11	/.openai/config	1
2026-10-11	/.openai/credentials	1
2026-10-11	/nuxt.config.js	1
2026-10-11	/openai.key	1
2026-10-11	/remix.config.js	1
2026-10-11	/env.cjs	1
2026-10-11	/env.config.js	1
2026-10-11	/env.config.json	1
2026-10-11	/environment.prod.ts	1
2026-10-11	/environment.staging.ts	1
2026-10-11	/environment.ts	1
2026-10-11	/src/environments/environment.ts	1
2026-10-11	/.env.authorizenet	1
2026-10-11	/.env.flutterwave	1
2026-10-11	/.env.mercadopago	1
2026-10-11	/authorizenet.json	1
2026-10-11	/mercadopago.json	1
2026-10-11	/supabase/.env	1
2026-10-11	/supabase/config.json	1
2026-10-11	/.env.activecampaign	1
2026-10-11	/.env.convertkit	1
2026-10-11	/.env.getresponse	1
2026-10-11	/.env.omnisend	1
2026-10-11	/activecampaign.json	1
2026-10-11	/getresponse.json	1
2026-10-11	/omnisend.json	1
2026-10-11	/.env.descope	1
2026-10-11	/.env.frontegg	1
2026-10-11	/.env.zitadel	1
2026-10-11	/descope.json	1
2026-10-11	/frontegg.json	1
2026-10-11	/supertokens.json	1
2026-10-11	/zitadel.json	1
2026-10-11	/admin/api/.env	1
2026-10-11	/api/admin/.env	1
2026-10-11	/cfg/.env	1
2026-10-11	/code/.env	1
2026-10-11	/git/.env	1
2026-10-11	/repo/.env	1
2026-10-11	/work/.env	1
2026-10-11	/workspace/.env	1
2026-10-12	/.env.ai21	1
2026-10-12	/.env.novita	1
2026-10-12	/.env.writer	1
2026-10-12	/ai21.json	1
2026-10-12	/writer.json	1
2026-10-12	/.env.grafana	1
2026-10-12	/.env.signoz	1
2026-10-12	/.env.statsig	1
2026-10-12	/.grafana/credentials	1
2026-10-12	/dynatrace.json	1
2026-10-12	/grafana.json	1
2026-10-13	/.env.langsmith	1
2026-10-13	/.env.portkey	1
2026-10-13	/helicone.json	1
2026-10-13	/langsmith.json	1
2026-10-13	/portkey.json	1
2026-10-13	/.anthropic/credentials.json	1
2026-10-13	/.claude/auth.json	1
2026-10-13	/.config/anthropic/credentials.json	1
2026-10-13	/.config/claude/auth.json	1
2026-10-13	/.config/gemini/auth.json	1
2026-10-13	/.gemini/auth.json	1
2026-10-13	/.config/claude/settings.json	1
2026-10-13	/.config/claude/settings.local.json	1
2026-10-13	/.config/gemini/config.json	1
2026-10-13	/.config/gemini/settings.json	1
2026-10-13	/.gemini/config.json	1
2026-10-13	/.gemini/settings.json	1
2026-10-13	/.env.convex	1
2026-10-13	/.env.nhost	1
2026-10-13	/convex.json	1
2026-10-13	/nhost.json	1
2026-10-13	/upstash.json	1
2026-10-13	/.azure/auth.json	1
2026-10-13	/.azure/config.json	1
2026-10-13	/.azure/credentials.json	1
2026-10-13	/.azure/credentials.xml	1
2026-10-13	/.config/gcloud/creds	1
2026-10-13	/.gsutil/boto	1
2026-10-16	/.api-keys	1
2026-10-16	/.api_keys	1
2026-10-16	/api_keys.json	1
2026-10-16	/apikeys.json	1
2026-10-16	/backend/keys/.env	1
2026-10-16	/backend/secrets/.env	1
2026-10-16	/config/api-keys.json	1
2026-10-16	/src/keys/.env	1
2026-10-16	/web/keys/.env	1
2026-10-16	/web/secrets/.env	1
2026-10-16	/.github/credentials	1
2026-10-16	/.github/token	1
2026-10-16	/.github/workflows/.env	1
2026-10-16	/.gitlab/.env	1
2026-10-16	/.gitlab/credentials	1
2026-10-17	/config/database.config.js	1
2026-10-17	/config/datasources.json	1
2026-10-17	/datasources.json	1
2026-10-17	/src/config/database.json	1
2026-10-17	/src/config/db.json	1
2026-10-17	/application-prod.properties	1
2026-10-17	/application-prod.yml	1
2026-10-17	/application.yaml	1
2026-10-17	/application.yml	1
2026-10-17	/etc/odoo.conf	1
2026-10-17	/manage/env	1
2026-10-17	/monitoring/env	1
2026-10-17	/nc/config/config.php	1
2026-10-17	/oc/config/config.php	1
2026-10-17	/odoo.conf	1
2026-10-17	/odoo/odoo.conf	1
2026-10-17	/owncloud/config/config.php	1
2026-10-17	/_cat/indices	1
2026-10-17	/_cluster/settings	1
2026-10-17	/_config	1
2026-10-17	/_nodes	1
2026-10-17	/_users	1
2026-10-17	/directus/.env	1
2026-10-17	/ghost/.env	1
2026-10-17	/keystone/.env	1
2026-10-17	/solr/admin/info/system	1
2026-10-17	/strapi/.env	1
2026-10-17	/wiki/.env	1
2026-10-17	/wikijs/.env	1
2026-10-18	/.env.pterodactyl	1
2026-10-18	/homeserver.yaml	1
2026-10-18	/matrix/.env	1
2026-10-18	/matrix/homeserver.yaml	1
2026-10-18	/pterodactyl/.env	1
2026-10-18	/zabbix/conf/zabbix.conf.php	1
2026-10-18	/config/database.yml	2
2026-10-18	/config/settings.py	1
2026-10-18	/myproject/settings.py	1
2026-10-18	/mysite/settings.py	1
2026-10-18	/project/settings.py	1
2026-10-18	/src/settings.py	1
2026-10-18	/.coder/credentials	1
2026-10-18	/.config/coder/credentials	1
2026-10-18	/.config/gitpod/credentials	1
2026-10-18	/.config/rclone/rclone.conf	1
2026-10-18	/.gitpod.yml	1
2026-10-18	/deta.toml	1
2026-10-18	/.config/hub	1
2026-10-18	/.env.deta	1
2026-10-18	/.env.northflank	1
2026-10-18	/.fly/config.toml	1
2026-10-18	/.github/workflows/cd.yml	1
2026-10-18	/.netlify/state.json	1
2026-10-18	/.nuget/NuGet.Config.bak	1
2026-10-18	/deta.env	1
2026-10-18	/fly/config.toml	1
2026-10-18	/northflank.json	1
2026-10-18	/nuget.config	1
2026-10-19	/.env.porter	1
2026-10-19	/.env.qovery	1
2026-10-19	/porter.json	1
2026-10-19	/porter.yaml	1
2026-10-19	/qovery.json	1
2026-10-19	/qovery.yaml	1
2026-10-19	/.env.kinsta	1
2026-10-19	/.env.lithic	1
2026-10-19	/.env.sardine	1
2026-10-19	/.env.sevalla	1
2026-10-19	/.env.wpvip	1
2026-10-19	/.github/workflows/alpha.yml	1
2026-10-19	/.github/workflows/beta.yml	1
2026-10-19	/.github/workflows/canary.yml	1
2026-10-19	/.github/workflows/hotfix.yml	1
2026-10-19	/.github/workflows/pr.yml	1
2026-10-19	/.github/workflows/push.yml	1
2026-10-19	/gitconfig	1
2026-10-19	/kinsta.json	1
2026-10-19	/lithic.json	1
2026-10-19	/sardine.json	1
2026-10-19	/sevalla.json	1
2026-10-19	/wpvip.json	1
2026-10-22	/serviceaccount.json	2
2026-10-22	/.continue/config.json	2
2026-10-22	/mcp.json	2
2026-10-22	/sentry.properties	17
2026-10-22	/.config/gcloud/application_default_credentials.json	1
2026-10-22	/.pypirc	1
2026-10-22	/newrelic.yml	1
2026-10-23	/.composer/auth.json	1
2026-10-23	/.cursor/mcp.json	17
2026-10-23	/.vscode/mcp.json	1
2026-10-23	/.netrc	16
2026-10-27	/error_log	2
2026-10-27	/server-status	1
2026-10-30	/.htaccess	7
2026-10-30	/actuator/env	7
2026-10-30	/api/actuator/env	7
2026-10-30	/server-info	7
2026-10-30	/settings.php	7
2026-10-30	/storage/logs/laravel.log	7
2026-10-30	/web.config	7