This IP address has been reported a total of
55
times from
10 distinct
sources.
172.64.200.60 was first reported on
November 22nd 2025 , and the most recent report was
13 hours ago Belarus
with 17
reports;
United States of America
with 6
reports;
Belgium
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
20
times;
Port Scan
6
times;
Bad Web Bot
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇧🇪
madeit
2026-10-08 13:19:41
(13 hours ago)
Web App Attack
2026-10-06 15:49:58
(2 days ago)
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.64.200.60 - - [06/Oct/2026:15:49:54 +0000] "GET /.git/HEAD HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [06/Oct/2026:15:49:55 +0000] "GET /.env.aws.local HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [06/Oct/2026:15:49:55 +0000] "GET /.env.openai HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [06/Oct/2026:15:49:55 +0000] "GET /.env.gpt HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [06/Oct/2026:15:49:56 +0000] "GET /.env.llm HTTP/1.1"
show less
Port Scan
🇧🇾
lns.bz
2026-10-03 20:37:38
(5 days ago)
.env scanning [BY]
Web App Attack
2026-10-01 22:55:20
(1 week ago)
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.64.200.60 - - [01/Oct/2026:22:55:12 +0000] "GET /portal/.env?v=18da89cd60d6c9d0 HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [01/Oct/2026:22:55:13 +0000] "GET /env/.env?v=18da89cdb06f442d HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [01/Oct/2026:22:55:14 +0000] "GET /api/.env?v=18da89cdf7957282 HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [01/Oct/2026:22:55:15 +0000] "GET /app/.env?v=18da89cc3dc63805 HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [01/Oct/2026:22:55:17 +0000] "GET /dev/.env?v=18da89cc5a86d93a HTTP/1.1"
show less
Port Scan
2026-09-26 09:11:15
(1 week ago)
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.64.200.60 - - [26/Sep/2026:09:11:12 +0000] "GET /.env-example HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [26/Sep/2026:09:11:12 +0000] "GET /.docker/laravel/app/.env HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [26/Sep/2026:09:11:12 +0000] "GET /.aws/credentials HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [26/Sep/2026:09:11:12 +0000] "GET /.aws/config HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [26/Sep/2026:09:11:12 +0000] "GET /.aws/.env HTTP/1.1"
show less
Port Scan
2026-09-23 13:57:01
(2 weeks ago)
172.64.200.60 - - [23/Sep/2026:13:57:00 +0000] "GET /wp-admin/install.php?step=1 HTTP/2.0" 404 892 " ...
show more
172.64.200.60 - - [23/Sep/2026:13:57:00 +0000] "GET /wp-admin/install.php?step=1 HTTP/2.0" 404 892 "-" "http://ashleybutcher.eu/wp-admin/install.php?step=1"
...
show less
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-09-23 09:17:08
(2 weeks ago)
.env scanning [BY]
Web App Attack
🇧🇪
madeit
2026-09-23 02:32:02
(2 weeks ago)
Web App Attack
🇧🇾
lns.bz
2026-09-21 06:06:00
(2 weeks ago)
.env scanning [BY]
Web App Attack
🇧🇾
lns.bz
2026-09-18 15:01:00
(2 weeks ago)
.env scanning [BY]
Web App Attack
2026-09-18 03:58:36
(2 weeks ago)
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.64.200.60 - - [18/Sep/2026:03:58:32 +0000] "GET /.env.dev HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [18/Sep/2026:03:58:32 +0000] "GET /.env.backup HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [18/Sep/2026:03:58:32 +0000] "GET /.env.bak HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [18/Sep/2026:03:58:32 +0000] "GET /.env.local HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [18/Sep/2026:03:58:32 +0000] "GET /.env HTTP/1.1"
show less
Port Scan
🇧🇾
lns.bz
2026-09-16 02:48:18
(3 weeks ago)
.env scanning [BY]
Web App Attack
🇧🇾
lns.bz
2026-09-14 04:33:26
(3 weeks ago)
Too many 404 requests [BY]
Web App Attack
2026-09-13 01:03:21
(3 weeks ago)
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 172.64.200.60 (PL/Poland/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.64.200.60 - - [13/Sep/2026:00:48:26 +0000] "GET /.aws/config HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [13/Sep/2026:00:48:38 +0000] "GET /.aws/credent HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [13/Sep/2026:00:48:42 +0000] "GET /.aws/credentials HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [13/Sep/2026:00:48:44 +0000] "GET /.aws/credentials.bak HTTP/1.1"
[REDACTED] 200 2627 172.64.200.60 - - [13/Sep/2026:01:03:17 +0000] "GET /.git/logs/HEAD HTTP/1.1"
show less
Port Scan
🇧🇾
lns.bz
2026-09-10 10:56:44
(4 weeks ago)
.env scanning [BY]
Web App Attack
Showing 1 to
15
of 55 reports
