here’s a running list of every ip trying to scrape me for credentials and env variables

I started paying closer attention to my website logs, and wow. There are a lot of requests looking for exposed Git configs, env files, credentials, and random WordPress or PHP stuff.

What caught my attention was the repeated suspicious checks for things that shouldn’t be public. So I’m keeping a running list of the ones I’ve blocked. If you want some IPs to look out for in your own logs, here you go.

Just to be clear, a probe doesn’t mean someone got in or stole anything. Some of these were checking for vulnerable software rather than credentials. IPs can also be shared or change hands, so use this as a starting point for checking your own traffic.

Blocklist last updated: October 24, 2026, 10:43 PM CDT. These are blocked across HTTP and HTTPS on my server.

Individual IPs — 32

Click any IP below to see its observed endpoints, methods, response codes, and retained log counts. These detail notes are accessible by link and kept out of my main portfolio listings.

• 8.230.20.204 — 272 distinct paths
• 18.177.154.54 — 1 distinct path
• 34.81.84.149 — 264 distinct paths
• 34.94.139.212 — 166 distinct paths
• 34.96.244.36 — 272 distinct paths
• 34.139.102.100 — 1 distinct path
• 34.143.172.68 — 272 distinct paths
• 34.178.203.149 — 203 distinct paths
• 35.197.107.68 — 203 distinct paths
• 35.205.131.43 — 46 distinct paths
• 45.134.79.120 — 10 distinct paths
• 45.138.12.52 — 90 distinct paths
• 52.187.230.78 — 81 distinct paths
• 74.225.203.7 — 128 distinct paths
• 93.152.209.6 — 96 distinct paths
• 94.54.237.166 — 1 distinct path
• 130.12.180.176 — 1 distinct path
• 144.172.118.107 — 1 distinct path
• 152.42.171.248 — 2 distinct paths
• 157.245.106.31 — 10 distinct paths
• 159.65.158.192 — 10 distinct paths
• 165.227.32.9 — 10 distinct paths
• 165.245.184.238 — 11 distinct paths
• 168.144.43.123 — 10 distinct paths
• 169.58.45.73 — 10 distinct paths
• 185.177.72.9 — 227 distinct paths
• 185.177.72.13 — 2,902 distinct paths
• 185.218.86.14 — 1 distinct path
• 187.251.217.14 — 1 distinct path
• 192.161.49.2 — 1 distinct path
• 195.178.110.159 — 14 distinct paths
• 223.238.162.45 — 1 distinct path

The detail pages use retained logs from October 22–25, 2026 (UTC). Log-entry counts can include duplicate logging. This is what I can still verify, not a complete lifetime history.

Network ranges I’ve also blocked — 2

• 45.138.12.0/24 — 45.138.12.0 through 45.138.12.255
• 195.178.110.0/24 — 195.178.110.0 through 195.178.110.255

Both ranges contain IPs that showed up in the suspicious traffic, and both were on Spamhaus DROP when checked on October 22, 2026. I’m not saying every IP in those ranges hit my sites. Two of the individual IPs above are already covered by these ranges, so the total is 542 unique blocked IPv4 addresses.

Latest additions — October 24, 2026, late evening

Three more. I checked the actual requests and looked for an identifiable crawler or service behind them. I could identify their networks, but not who was making the requests. None had a reverse-DNS hostname when checked.

• 165.245.184.238 — a DigitalOcean address. Made 11 requests for KCFinder PHP upload paths on JoyPass.
• 130.12.180.176 — registered to Virtualine Technologies. Requested /.env on my portfolio.
• 94.54.237.166 — on the Türksat network. Sent a POST to /xmlrpc.php on Beacon.

All 13 requests returned 404. I blocked these three exact IPs, not their providers’ networks. The provider names don’t identify whoever was running the probes.

Earlier addition — October 24, 2026, evening

93.152.209.6 — showed up in my log watch with 40 matches. I’ve blocked it. I’ve since recovered 96 distinct paths from the retained logs, including /.npmrc, /.kube/config, /config/master.key, and backup files. The linked note has the full observed list.

Earlier additions — October 24, 2026

Seven more from the earlier log review:

• 185.177.72.13 — probing for Git files, env files, PHP, and credentials.
• 185.177.72.9 — looking for configuration backups and PHP files.
• 34.143.172.68, 34.178.203.149, 35.197.107.68, and 34.94.139.212 — automated checks for PHP-info pages.
• 192.161.49.2 — trying directory traversal to reach /etc/passwd.

I’ll keep this updated as I find more. If I learn something that changes an entry, I’ll update that too.