IP Address: 217.60.76.167

ipban 1.9.0

signals: stolen-credential-use

[arem1] 2026-09-30 03:12:14, Client: 217.60.76.167, Protocol: 6, Unauthorized activity to HTTP: GET /.env

[probe-168-134] 2026-09-30 01:49:20, Client: 217.60.76.167, Protocol: 6, Unauthorized activity to HTTP: GET /.env

Automated web attack: 132 reqs, 127 paths probed, 119 returned 404; probed: 78 .env, 10 other, 6 .json, 6 .php, 5 config, 4 .yml, 4 secret, 3 .sql, 3 .xml, 2 .git, 2 script, 1 .jsp, 1 admin, 1 backup, 1 cloud-cred

Automated web attack: 3 reqs, 2 paths probed, 1 returned 404; probed: 1 .env, 1 .php

Automated web attack: 3 reqs, 2 paths probed, 1 returned 404; signals: stolen-credential-use; probed: 1 .env, 1 .php

[rede-188] 2026-09-16 01:05:23, Client: 217.60.76.167, Protocol: 6, Unauthorized activity to HTTP: GET /.env

Automated web attack: 2 reqs, 2 paths probed, 1 returned 404; probed: 1 .env, 1 .php

[probe-44-49] 2026-09-15 22:02:43, Client: 217.60.76.167, Protocol: 6, Unauthorized activity to HTTP: GET /.env

[probe-44-49] 2026-09-12 23:51:09, Client: 217.60.76.167, Protocol: 6, Unauthorized activity to HTTP: GET /.env