Home › Hall of Shame
Last 30 days
Hall of Shame
Every network that probed pfBlockerNG.com for files a static site doesn't have. Each one is called up with what it did, then dropped. The more it tried, the deeper it sinks. Updated 13 Oct 2026.
- 32addresses
- 2,632probe requests
- 6addresses with bursts of 100+ requests in 10 s
- 5addresses blocked by the firewall
#1 of 25: 89.117.46.x, PA
Depth shows probe hits (log scale). Size shows the biggest burst in 10 s.
Circle colour: what it looked for
- .env theft11 networks
- web shells4 networks
- WordPress break-in3 networks
- .git download3 networks
- phpinfo snooping1 network
- dotfile snooping3 networks
Ring: how it was handled
- Probe only, plain circle17 networks
- Burst: 100+ requests in 10 s6 networks
- Blocked by the Cloudflare firewall5 networks
Show as table
| Network | Country | Provider | What it did | Probe hits | Peak per 10 s | Days seen |
|---|---|---|---|---|---|---|
| 89.117.46.x | PA | - | WordPress break-in | 730 | 39 | 1 |
| 20.213.164.x | AU | - | web shells, burst | 566 | 359 | 1 |
| 35.219.137.x | US | Google Cloud | phpinfo snooping, burst | 255 | 158 | 1 |
| 35.213.217.x | AU | Google Cloud | .env theft, burst, firewall block | 250 | 271 | 1 |
| 34.52.133.x | BE | Google Cloud | .env theft, burst, firewall block | 185 | 258 | 1 |
| 34.47.46.x | CA | Google Cloud | .env theft, burst, firewall block | 183 | 395 | 1 |
| 130.12.180.x | DE | - | .env theft | 126 | 51 | 1 |
| 20.200.211.x | KR | - | web shells | 94 | 94 | 1 |
| 158.23.176.x | MX | - | web shells | 91 | 95 | 1 |
| 170.64.215.x | AU | - | web shells, burst | 65 | 104 | 1 |
| 45.138.12.x | PL | - | dotfile snooping | 21 | 24 | 1 |
| 54.76.211.x | IE | AWS | dotfile snooping | 9 | 28 | 1 |
| 3.248.4.x | IE | AWS | dotfile snooping | 7 | 26 | 1 |
| 2602:fa59:10:x | US | - | .git download | 6 | 2 | 2 |
| 159.89.127.x | CA | - | WordPress break-in, firewall block | 5 | 5 | 1 |
| 139.59.132.x | DE | LeakIX (scanner) | .env theft | 4 | 14 | 1 |
| 157.245.204.x | SG | LeakIX (scanner) | .env theft | 4 | 14 | 1 |
| 159.89.12.x | DE | LeakIX (scanner) | .env theft | 4 | 14 | 1 |
| 206.189.95.x | SG | LeakIX (scanner) | .env theft | 4 | 14 | 1 |
| 209.38.208.x | DE | LeakIX (scanner) | .env theft | 4 | 14 | 1 |
| 157.245.105.x | IN | LeakIX (scanner) | .env theft | 4 | 13 | 1 |
| 46.151.182.x | SC | - | .env theft | 2 | 19 | 1 |
| 93.123.109.x | NL | - | .git download | 2 | 10 | 1 |
| 138.68.132.x | GB | - | WordPress break-in | 2 | 2 | 1 |
| 45.130.203.x | DE | - | .git download, firewall block | 2 | 1 | 1 |
Daily probes
3,0001,500
7 Oct 2026 to 13 Oct 2026. Tallest bar: 2,132 probes. Collection started 11 Oct 2026.
Notes
Addresses are masked to the network (IPv4 /24, IPv6 /48). Cloud addresses are reassigned often; a listed network is not an accusation against its current owner. Observed probing this site; if you believe a listing is wrong, email contact@pfblockerng.com.