45.138.12.52 — observed request history

← Back to my full IP blocklist

I blocked 45.138.12.52. Here are the request paths I found in my retained logs.

90 distinct paths · 140 matching log entries

First retained entry: 2026-10-22T16:13:35.310Z. Last retained entry: 2026-10-22T16:14:06.094Z. All timestamps are UTC.

Where it showed up

• doomo / joypass-co — 140 log entries

Observed endpoints

Each line shows the path, HTTP method, recorded status codes, and log-entry count. Counts may include duplicate logging and are not necessarily unique requests. “Unknown” means the status was not captured in the normalized entry.

/.aws/config | GET | unknown | 2
/.aws/config.bak | GET | unknown | 2
/.aws/config.json | GET | unknown | 2
/.aws/credentials | GET | unknown | 2
/.aws/env | GET | unknown | 2
/.aws/env.bak | GET | unknown | 2
/.aws/secret.json | GET | unknown | 2
/.docker/laravel/app/.env | GET | unknown | 2
/.env | GET | unknown | 1
/.env-example | GET | unknown | 1
/.env.ai | GET | unknown | 1
/.env.anthropic | GET | unknown | 1
/.env.aws | GET | unknown | 1
/.env.aws.local | GET | unknown | 1
/.env.backup | GET | unknown | 1
/.env.bak | GET | unknown | 1
/.env.debug | GET | unknown | 1
/.env.dev | GET | unknown | 1
/.env.development | GET | unknown | 1
/.env.example | GET | unknown | 1
/.env.save | GET | unknown | 1
/.git/HEAD | GET | unknown | 2
/.git/config | GET | unknown | 2
/.git/description | GET | unknown | 2
/.git/index | GET | unknown | 2
/.git/logs/HEAD | GET | unknown | 2
/.git/packed-refs | GET | unknown | 2
/.ssh/id_rsa | GET | unknown | 2
/_profiler/phpinfo | GET | unknown | 2
/actuator | GET | unknown | 1
/actuator/beans | GET | unknown | 2
/actuator/configprops | GET | unknown | 2
/actuator/env | GET | unknown | 2
/actuator/gateway/routes | GET | unknown | 2
/actuator/health | GET | unknown | 2
/actuator/heapdump | GET | unknown | 2
/ai/config.json | GET | unknown | 2
/ai/config.yaml | GET | unknown | 2
/ai/config.yml | GET | unknown | 2
/ai/credentials | GET | unknown | 2
/api/.env | GET | unknown | 2
/api/secrets.yml | GET | unknown | 2
/app/.env | GET | unknown | 2
/application-dev.yml | GET | unknown | 1
/application-prod.yml | GET | unknown | 1
/application.properties | GET | unknown | 1
/application.yaml | GET | unknown | 1
/application.yml | GET | unknown | 1
/appsettings.json | GET | unknown | 1
/assets/env.js | GET | unknown | 2
/aws/credentials.env | GET | unknown | 2
/aws/secret.env | GET | unknown | 2
/aws/secret.txt | GET | unknown | 2
/aws/secrets.env | GET | unknown | 2
/aws/secrets.json | GET | unknown | 2
/aws/secrets.txt | GET | unknown | 2
/backend/.env | GET | unknown | 2
/backup.sql | GET | unknown | 1
/backup.tar.gz | GET | unknown | 1
/backup.zip | GET | unknown | 1
/backup/db.sql | GET | unknown | 2
/bedrock/config.json | GET | unknown | 2
/blog/wp-config.php | GET | unknown | 2
/composer.lock | GET | unknown | 1
/config.js | GET | unknown | 1
/config.php | GET | unknown | 1
/config.php.bak | GET | unknown | 1
/config/application.yml | GET | unknown | 2
/configuration.php | GET | unknown | 1
/database.sql | GET | unknown | 1
/dump.sql | GET | unknown | 1
/home/*/.aws/config | GET | unknown | 2
/home/*/.aws/credentials | GET | unknown | 2
/html.zip | GET | unknown | 1
/id_rsa | GET | unknown | 1
/id_rsa.pub | GET | unknown | 1
/laravel/.env | GET | unknown | 2
/phpinfo.php | GET | unknown | 1
/public_html.zip | GET | unknown | 1
/root/.aws/config | GET | unknown | 2
/root/.aws/credentials | GET | unknown | 2
/server/.env | GET | unknown | 2
/site.sql | GET | unknown | 1
/site.zip | GET | unknown | 1
/src/.env | GET | unknown | 2
/storage/logs/laravel.log | GET | unknown | 2
/wordpress/wp-config.php | GET | unknown | 2
/wp-config.php.old | GET | unknown | 1
/wp-config.php.save | GET | unknown | 1
/wp-config.php.txt | GET | unknown | 1

About this record

I pulled this list from retained Vitals logs on October 25, 2026 (UTC), with coverage back to October 22. This is the history I can still verify, not a complete lifetime history. Query strings and fragments are omitted. A response code alone does not prove that credentials were exposed.

Source attribution recorded by Vitals: reported_unverified. Reported or forwarded addresses are not independently verified identities. An IP can be shared or reassigned.

Back to my full IP blocklist. I’ll keep this updated as I find more.