here’s a running list of every ip trying to scrape me for credentials and env variables

I started paying closer attention to my website logs, and wow. There are a lot of requests looking for exposed Git configs, env files, credentials, and random WordPress or PHP stuff.

In the requests I’ve reviewed from these IPs, I haven’t seen any legit-looking traffic. Just suspicious checks for things that shouldn’t be public. So I’m keeping a running list of the ones I’ve blocked. If you want some IPs to look out for in your own logs, here you go.

Just to be clear, a probe doesn’t mean someone got in or stole anything. Some of these were checking for vulnerable software rather than credentials. IPs can also be shared or change hands, so use this as a starting point for checking your own traffic.

Blocklist last updated: October 24, 2026, 7:15 PM CDT. These are blocked across HTTP and HTTPS on my server.

Individual IPs — 29

8.230.20.204
18.177.154.54
34.81.84.149
34.94.139.212
34.96.244.36
34.139.102.100
34.143.172.68
34.178.203.149
35.197.107.68
35.205.131.43
45.134.79.120
45.138.12.52
52.187.230.78
74.225.203.7
93.152.209.6
144.172.118.107
152.42.171.248
157.245.106.31
159.65.158.192
165.227.32.9
168.144.43.123
169.58.45.73
185.177.72.9
185.177.72.13
185.218.86.14
187.251.217.14
192.161.49.2
195.178.110.159
223.238.162.45

Network ranges I’ve also blocked — 2

• 45.138.12.0/24 — 45.138.12.0 through 45.138.12.255
• 195.178.110.0/24 — 195.178.110.0 through 195.178.110.255

Both ranges contain IPs that showed up in the suspicious traffic, and both were on Spamhaus DROP when checked on October 22, 2026. I’m not saying every IP in those ranges hit my sites. Two of the individual IPs above are already covered by these ranges, so the total is 539 unique blocked IPv4 addresses.

Latest addition — October 24, 2026, evening

93.152.209.6 — showed up in my log watch with 40 matches. I’ve blocked it. The watch summary doesn’t show the individual request paths, so I’m not assigning a specific type of probe to this entry yet.

Earlier additions — October 24, 2026

Seven more from the earlier log review:

• 185.177.72.13 — probing for Git files, env files, PHP, and credentials.
• 185.177.72.9 — looking for configuration backups and PHP files.
• 34.143.172.68, 34.178.203.149, 35.197.107.68, and 34.94.139.212 — automated checks for PHP-info pages.
• 192.161.49.2 — trying directory traversal to reach /etc/passwd.

I’ll keep this updated as I find more. If I learn something that changes an entry, I’ll update that too.