93.152.209.6 — observed request history

← Back to my full IP blocklist

I blocked 93.152.209.6. Here are the request paths I found in my retained logs.

96 distinct paths · 186 matching log entries

First retained entry: 2026-10-23T17:18:19.573Z. Last retained entry: 2026-10-24T22:28:45.532Z. All timestamps are UTC.

Where it showed up

• doomo / registry — 186 log entries

Observed endpoints

Each line shows the path, HTTP method, recorded status codes, and log-entry count. Counts may include duplicate logging and are not necessarily unique requests. “Unknown” means the status was not captured in the normalized entry.

/.aws/credentials | GET | 404 | 2
/.docker/config.json | GET | 404 | 2
/.env | GET | 404 | 2
/.env.backup | GET | 404 | 2
/.env.bak | GET | 404 | 2
/.env.development | GET | 404 | 2
/.env.dist | GET | 404 | 2
/.env.example | GET | 404 | 2
/.env.local | GET | 404 | 2
/.env.local.backup | GET | 404 | 1
/.env.old | GET | 404 | 2
/.env.production | GET | 404 | 2
/.env.production.backup | GET | 404 | 2
/.env.production.local | GET | 404 | 2
/.env.save | GET | 404 | 2
/.env.staging | GET | 404 | 2
/.env.test | GET | 404 | 2
/.git-credentials | GET | 404 | 2
/.git/HEAD | GET | 404 | 2
/.git/config | GET | 404 | 2
/.git/logs/HEAD | GET | 404 | 2
/.gitlab-ci.yml | GET | 404 | 2
/.htaccess | GET | 404 | 2
/.htpasswd | GET | 404 | 2
/.kube/config | GET | 404 | 2
/.npmrc | GET | 404 | 2
/.npmrc._default | GET | 404 | 2
/.ssh/config | GET | 404 | 2
/.ssh/id_ecdsa | GET | 404 | 2
/.ssh/id_ed25519 | GET | 404 | 2
/.ssh/id_rsa | GET | 404 | 2
/.yarnrc.yml | GET | 404 | 1
/Dockerfile | GET | 404 | 2
/Jenkinsfile | GET | 404 | 2
/adminer.php | GET | 404 | 2
/adminer.sql | GET | 404 | 2
/airflow.cfg | GET | 404 | 2
/api/.env | GET | 404 | 2
/app/.env | GET | 404 | 2
/application-prod.properties | GET | 404 | 2
/application-prod.yml | GET | 404 | 2
/application.properties | GET | 404 | 2
/application.properties.bak | GET | 404 | 2
/application.yml | GET | 404 | 2
/appsettings.production.json | GET | 404 | 2
/backup.sql | GET | 404 | 2
/backup.tar.gz | GET | 404 | 2
/backup.zip | GET | 404 | 2
/backup/.env | GET | 404 | 2
/backups/.env | GET | 404 | 2
/config.js | GET | 404 | 2
/config.json | GET | 404 | 2
/config.php | GET | 404 | 2
/config.py | GET | 404 | 2
/config/.env | GET | 404 | 2
/config/database.yml | GET | 404 | 2
/config/master.key | GET | 404 | 2
/config/secrets.yml | GET | 404 | 2
/configuration.php | GET | 404 | 2
/credentials.json | GET | 404 | 2
/credentials.yml | GET | 404 | 2
/current/.env | GET | 404 | 2
/database.sql | GET | 404 | 2
/database.yml | GET | 404 | 2
/db.sql | GET | 404 | 2
/db.sql.gz | GET | 404 | 2
/debug.log | GET | 404 | 2
/deployment.yaml | GET | 404 | 2
/docker-compose.yml | GET | 404 | 2
/dump.sql | GET | 404 | 2
/ecosystem.config.js | GET | 404 | 2
/error.log | GET | 404 | 2
/html/.env | GET | 404 | 2
/info.php | GET | 404 | 2
/kmonbaseqtda294c17 | GET | 404 | 1
/kmonbaseqtf0792056 | GET | 404 | 1
/kmonbasezd77da9ef9 | GET | 404 | 1
/kmonbasezd7bb5a393 | GET | 404 | 1
/laravel.log | GET | 404 | 2
/old/.env | GET | 404 | 2
/package.json | GET | 404 | 2
/phpinfo.php | GET | 404 | 2
/public_html/.env | GET | 404 | 2
/releases/.env | GET | 404 | 2
/secrets.json | GET | 404 | 2
/secrets.py | GET | 404 | 2
/secrets.yaml | GET | 404 | 2
/server/.env | GET | 404 | 2
/settings.py | GET | 404 | 2
/terraform.tfstate | GET | 404 | 2
/terraform.tfstate.backup | GET | 404 | 2
/web.config | GET | 404 | 2
/wp-config.php | GET | 404 | 2
/wp-config.php.bak | GET | 404 | 2
/www.zip | GET | 404 | 2
/www/.env | GET | 404 | 2

About this record

I pulled this list from retained Vitals logs on October 25, 2026 (UTC), with coverage back to October 22. This is the history I can still verify, not a complete lifetime history. Query strings and fragments are omitted. A response code alone does not prove that credentials were exposed.

Source attribution recorded by Vitals: logged_peer. Reported or forwarded addresses are not independently verified identities. An IP can be shared or reassigned.

Back to my full IP blocklist. I’ll keep this updated as I find more.