Part of series

here’s a running list of every ip trying to scrape me for credentials and env variables
• 9 min read

185.177.72.9 — observed request history

Security IP history

← Back to my full IP blocklist

I blocked 185.177.72.9. Here are the request paths I found in my retained logs.

227 distinct paths · 227 matching log entries

First retained entry: 2026-10-24T12:00:04.509Z. Last retained entry: 2026-10-24T12:00:42.085Z. All timestamps are UTC.

Where it showed up

Observed endpoints

Each line shows the path, HTTP method, recorded status codes, and log-entry count. Counts may include duplicate logging and are not necessarily unique requests. “Unknown” means the status was not captured in the normalized entry.

/%c0 | GET | 200 | 1
/.aws/config | GET | 404 | 1
/.aws/credentials | GET | 404 | 1
/.docker/.env | GET | 404 | 1
/.docker/laravel/app/.env | GET | 404 | 1
/.env | GET | 404 | 1
/.env-example | GET | 404 | 1
/.env-sample | GET | 404 | 1
/.env.2 | GET | 404 | 1
/.env.backup | GET | 404 | 1
/.env.bak | GET | 404 | 1
/.env.dev | GET | 404 | 1
/.env.dev.local | GET | 404 | 1
/.env.development | GET | 404 | 1
/.env.development.local | GET | 404 | 1
/.env.development.sample | GET | 404 | 1
/.env.dist | GET | 404 | 1
/.env.docker | GET | 404 | 1
/.env.docker.dev | GET | 404 | 1
/.env.example | GET | 404 | 1
/.env.live | GET | 404 | 1
/.env.local | GET | 404 | 1
/.env.old | GET | 404 | 1
/.env.php | GET | 404 | 1
/.env.prod | GET | 404 | 1
/.env.prod.local | GET | 404 | 1
/.env.production | GET | 404 | 1
/.env.production.local | GET | 404 | 1
/.env.sample | GET | 404 | 1
/.env.sample.php | GET | 404 | 1
/.env.save | GET | 404 | 1
/.env.stage | GET | 404 | 1
/.env.staging | GET | 404 | 1
/.env.test | GET | 404 | 1
/.env.test.local | GET | 404 | 1
/.env.test.sample | GET | 404 | 1
/.env.travis | GET | 404 | 1
/.env.txt | GET | 404 | 1
/.env.www | GET | 404 | 1
/.env1 | GET | 404 | 1
/.env_1 | GET | 404 | 1
/.env_bak | GET | 404 | 1
/.env_example | GET | 404 | 1
/.env_old | GET | 404 | 1
/.env_sample | GET | 404 | 1
/.environment | GET | 404 | 1
/.envrc | GET | 404 | 1
/.envs | GET | 404 | 1
/.flaskenv | GET | 404 | 1
/.ghc.environment | GET | 404 | 1
/.hsenv | GET | 404 | 1
/.jenv-version | GET | 404 | 1
/.pam_environment | GET | 404 | 1
/.powenv | GET | 404 | 1
/.rbenv-gemsets | GET | 404 | 1
/.rbenv-version | GET | 404 | 1
/.venv | GET | 404 | 1
/.vscode/.env | GET | 404 | 1
/.zshenv | GET | 404 | 1
/_info.php | GET | 404 | 1
/_phpinfo.php | GET | 404 | 1
/_profiler/phpinfo | GET | 404 | 1
/_profiler/phpinfo/info.php | GET | 404 | 1
/_profiler/phpinfo/phpinfo.php | GET | 404 | 1
/admin/.env | GET | 404 | 1
/admin/admin_phpinfo.php4 | GET | 404 | 1
/admin/config | GET | 404 | 1
/admin/config.php | GET | 404 | 1
/admin/phpinfo.php | GET | 404 | 1
/admin_info.php | GET | 404 | 1
/admin_phpinfo.php | GET | 404 | 1
/administrator/.env | GET | 404 | 1
/ansible/.env | GET | 404 | 1
/api | GET | 404 | 1
/api/.env | GET | 404 | 1
/api/config.php | GET | 404 | 1
/api_keys.json | GET | 404 | 1
/app/.env | GET | 404 | 1
/app/config.json | GET | 404 | 1
/app/config.php | GET | 404 | 1
/app/settings.php | GET | 404 | 1
/application/.env | GET | 404 | 1
/aws-credentials.txt | GET | 404 | 1
/aws-secret.yaml | GET | 404 | 1
/aws.json | GET | 404 | 1
/awstats/.env | GET | 404 | 1
/backend | GET | 404 | 1
/backend/.env | GET | 404 | 1
/backend/config.php | GET | 404 | 1
/backup/.env | GET | 404 | 1
/backup/config.php | GET | 404 | 1
/bootstrap/cache/config.php | GET | 404 | 1
/client/.env | GET | 404 | 1
/cms/.env | GET | 404 | 1
/composer.lock | GET | 404 | 1
/conf/.env | GET | 404 | 1
/config.env | GET | 404 | 1
/config.json | GET | 404 | 1
/config.php | GET | 404 | 1
/config.php.bak | GET | 404 | 1
/config.php.save | GET | 404 | 1
/config/.env | GET | 404 | 1
/config/app.php | GET | 404 | 1
/config/aws.json | GET | 404 | 1
/config/config.json | GET | 404 | 1
/config/config.php | GET | 404 | 1
/config/database.json | GET | 404 | 1
/config/database.php | GET | 404 | 1
/config/database.yml | GET | 404 | 1
/config/mail.json | GET | 404 | 1
/config/mail.php | GET | 404 | 1
/config/mailgun.json | GET | 404 | 1
/config/secrets.json | GET | 404 | 1
/config/sendgrid.json | GET | 404 | 1
/config/services.php | GET | 404 | 1
/config/settings.ini | GET | 404 | 1
/config/settings.php | GET | 404 | 1
/config/smtp.php | GET | 404 | 1
/configuration.php | GET | 404 | 1
/core/.env | GET | 404 | 1
/crm/.env | GET | 404 | 1
/cron/.env | GET | 404 | 1
/dashboard/.env | GET | 404 | 1
/database.yml | GET | 404 | 1
/dbinfo.php | GET | 404 | 1
/deployment/.env | GET | 404 | 1
/dev/.env | GET | 404 | 1
/docker.sh | GET | 404 | 1
/docker/.env | GET | 404 | 1
/docker/app/.env | GET | 404 | 1
/dump.sh | GET | 404 | 1
/env | GET | 404 | 1
/env.backup | GET | 404 | 1
/env.bak | GET | 404 | 1
/env.js | GET | 404 | 1
/env.json | GET | 404 | 1
/env.list | GET | 404 | 1
/env.php | GET | 404 | 1
/env.prod.js | GET | 404 | 1
/env.test.js | GET | 404 | 1
/env.txt | GET | 404 | 1
/env/.env | GET | 404 | 1
/environment | GET | 404 | 1
/environment.ts | GET | 404 | 1
/envrc | GET | 404 | 1
/frontend/.env | GET | 404 | 1
/helm/.env | GET | 404 | 1
/info | GET | 404 | 1
/info.php | GET | 404 | 1
/info.php.1 | GET | 404 | 1
/info.php.back | GET | 404 | 1
/info.php.bak | GET | 404 | 1
/info.php.save.1 | GET | 404 | 1
/info.php_ | GET | 404 | 1
/js/.env | GET | 404 | 1
/k8s/.env | GET | 404 | 1
/keys.json | GET | 404 | 1
/lara/info.php | GET | 404 | 1
/lara/phpinfo.php | GET | 404 | 1
/laravel/.env | GET | 404 | 1
/laravel/.env.local | GET | 404 | 1
/laravel/.env.production | GET | 404 | 1
/laravel/.env.staging | GET | 404 | 1
/laravel/core/.env | GET | 404 | 1
/laravel/core/.env.local | GET | 404 | 1
/laravel/core/.env.production | GET | 404 | 1
/laravel/core/.env.staging | GET | 404 | 1
/laravel/info.php | GET | 404 | 1
/local/.env | GET | 404 | 1
/mail/.env | GET | 404 | 1
/mailer/.env | GET | 404 | 1
/main/.env | GET | 404 | 1
/new/.env | GET | 404 | 1
/new/.env.local | GET | 404 | 1
/new/.env.production | GET | 404 | 1
/new/.env.staging | GET | 404 | 1
/newinfo.php | GET | 404 | 1
/nginx/.env | GET | 404 | 1
/pageinfo.php | GET | 404 | 1
/php-info.php | GET | 404 | 1
/php5.ini | GET | 404 | 1
/phpbb/phpinfo.php | GET | 404 | 1
/phpinfo | GET | 404 | 1
/phpinfo.php | GET | 404 | 1
/phpinfo.php.bak | GET | 404 | 1
/phpinfo.php.txt | GET | 404 | 1
/phpinfo.php3 | GET | 404 | 1
/pi.php | GET | 404 | 1
/pinfo.php | GET | 404 | 1
/pms | GET | 404 | 1
/portal/.env | GET | 404 | 1
/printenv | GET | 404 | 1
/printenv.tmp | GET | 404 | 1
/private/.env | GET | 404 | 1
/private/config.php | GET | 404 | 1
/private/keys.json | GET | 404 | 1
/production/.env | GET | 404 | 1
/public/.env | GET | 404 | 1
/release_info.php | GET | 404 | 1
/secrets.json | GET | 404 | 1
/secrets/config.json | GET | 404 | 1
/sendgrid.json | GET | 404 | 1
/server-info | GET | 404 | 1
/server.key | GET | 404 | 1
/server/.env | GET | 404 | 1
/settings.php | GET | 404 | 1
/site/.env | GET | 404 | 1
/siteinfo.php | GET | 404 | 1
/src/.env | GET | 404 | 1
/src/app.js | GET | 404 | 1
/src/config.php | GET | 404 | 1
/staging/.env | GET | 404 | 1
/storage/app/private/.env | GET | 404 | 1
/storage/logs/laravel.log | GET | 404 | 1
/terraform/.env | GET | 404 | 1
/test.php | GET | 404 | 1
/test/.env | GET | 404 | 1
/test/info.php | GET | 404 | 1
/test/phpinfo.php | GET | 404 | 1
/web/.env | GET | 404 | 1
/wp-config | GET | 404 | 1
/wp-config.php | GET | 404 | 1
/wp-config.php.backup | GET | 404 | 1
/wp-config.php.bak | GET | 404 | 1
/www/.env | GET | 404 | 1
/xampp/.env | GET | 404 | 1
/xampp/phpinfo.php | GET | 404 | 1

About this record

I pulled this list from retained Vitals logs on October 25, 2026 (UTC), with coverage back to October 22. This is the history I can still verify, not a complete lifetime history. Query strings and fragments are omitted. A response code alone does not prove that credentials were exposed.

Source attribution recorded by Vitals: reported_unverified. Reported or forwarded addresses are not independently verified identities. An IP can be shared or reassigned.

Back to my full IP blocklist. I’ll keep this updated as I find more.

• • •
Arron Taylor

Arron Taylor

Software engineer building products that matter. Writing about faith, technology, and life in Milwaukee.

Join the Conversation

Your feedback is valuable. React to the post or share your thoughts below.

Comments

No comments yet. Be the first to share your thoughts!

Interested in working together?

I'm always open to discussing new projects and opportunities.

© 2026 Arron Taylor · Built with ♥ in Milwaukee