here’s a running list of every ip trying to scrape me for credentials and env variables

I started paying closer attention to my website logs, and wow. There are a lot of requests looking for exposed Git configs, env files, credentials, and random WordPress or PHP stuff.

In the requests I’ve reviewed from these IPs, I haven’t seen any legit-looking traffic. Just suspicious checks for things that shouldn’t be public. So I’m keeping a running list of the ones I’ve blocked. If you want some IPs to look out for in your own logs, here you go.

Just to be clear, a probe doesn’t mean someone got in or stole anything. Some of these were checking for vulnerable software rather than credentials. IPs can also be shared or change hands, so use this as a starting point for checking your own traffic.

Blocklist last updated: October 24, 2026, 10:43 PM CDT. These are blocked across HTTP and HTTPS on my server.

Individual IPs — 32

8.230.20.204
18.177.154.54
34.81.84.149
34.94.139.212
34.96.244.36
34.139.102.100
34.143.172.68
34.178.203.149
35.197.107.68
35.205.131.43
45.134.79.120
45.138.12.52
52.187.230.78
74.225.203.7
93.152.209.6
94.54.237.166
130.12.180.176
144.172.118.107
152.42.171.248
157.245.106.31
159.65.158.192
165.227.32.9
165.245.184.238
168.144.43.123
169.58.45.73
185.177.72.9
185.177.72.13
185.218.86.14
187.251.217.14
192.161.49.2
195.178.110.159
223.238.162.45

Network ranges I’ve also blocked — 2

• 45.138.12.0/24 — 45.138.12.0 through 45.138.12.255
• 195.178.110.0/24 — 195.178.110.0 through 195.178.110.255

Both ranges contain IPs that showed up in the suspicious traffic, and both were on Spamhaus DROP when checked on October 22, 2026. I’m not saying every IP in those ranges hit my sites. Two of the individual IPs above are already covered by these ranges, so the total is 542 unique blocked IPv4 addresses.

Latest additions — October 24, 2026, late evening

Three more. I checked the actual requests and looked for an identifiable crawler or service behind them. I could identify their networks, but not who was making the requests. None had a reverse-DNS hostname when checked.

• 165.245.184.238 — a DigitalOcean address. Made 11 requests for KCFinder PHP upload paths on JoyPass.
• 130.12.180.176 — registered to Virtualine Technologies. Requested /.env on my portfolio.
• 94.54.237.166 — on the Türksat network. Sent a POST to /xmlrpc.php on Beacon.

All 13 requests returned 404. I blocked these three exact IPs, not their providers’ networks. The provider names don’t identify whoever was running the probes.

Earlier addition — October 24, 2026, evening

93.152.209.6 — showed up in my log watch with 40 matches. I’ve blocked it. The watch summary doesn’t show the individual request paths, so I’m not assigning a specific type of probe to this entry yet.

Earlier additions — October 24, 2026

Seven more from the earlier log review:

• 185.177.72.13 — probing for Git files, env files, PHP, and credentials.
• 185.177.72.9 — looking for configuration backups and PHP files.
• 34.143.172.68, 34.178.203.149, 35.197.107.68, and 34.94.139.212 — automated checks for PHP-info pages.
• 192.161.49.2 — trying directory traversal to reach /etc/passwd.

I’ll keep this updated as I find more. If I learn something that changes an entry, I’ll update that too.