The lesson is simple: If you find one of your own files via inurl:userpwd.txt , consider it a breach in progress and act immediately.
Every day, Google’s crawlers index thousands of new .txt files. Some contain recipes. Some contain term papers. And a surprising number contain the keys to the kingdom.
[Database] host = localhost user = root pass = SuperSecret123 db_name = customer_orders [FTP] ftp_user = transferbot ftp_pass = filezill@2020
location ~* \.(txt|sql|log|bak)$ deny all;
Google offers advanced search operators—special commands that refine search results. The inurl: operator tells Google to show only pages where the specified term appears inside the URL itself.