abuseip.org
- Reason
- suspicious paths across 2 domains
- Hits (last hour)
- 64
- Unique targets hit
- 2
- Unique paths probed
- 120
- Detection count
- 14
- First seen
- 2026-06-27 02:02:56 UTC
- Last seen
- 2026-06-27 02:07:23 UTC
- Block expires
- 2026-06-28 03:02:15 UTC
Sample paths probed
- /.env.php?v=ypDTY&_=DddQSLTX
- /.env%00.txt?v=AISvk&_=LguRFPtT
- /.%65nv.local?v=3kIIP&_=J42ECMxb
- /.%65nv?v=8p8Jr&_=qB8cVr9Q
- /.env%00.php?v=9bm3m&_=kr9J9EwJ
- /.%65nv?v=fY1Wz&_=ggR5HSrX
- /.env~?v=YaCdu&_=UplIDRoT
- /.env~?v=r6fPf&_=9XajdlSW
- /.%65nv.backup?v=tF7sm&_=dC4AiRXQ
- /.env.txt?v=nfhaU&_=1NQquB7h
- /.%65nv.backup?v=YBU44&_=wbgCkU2y
- /.env%00.txt?v=u8iWi&_=Gk1GgPch
- /.env.php?v=UlmxC&_=YQKKuQnG
- /.env%00.php?v=NJPMo&_=4ztjNHfR
- /.env%00?v=ncCQ1&_=i23V8ora
- /%252Eenv?v=IMvxJ&_=V5mPnoAA
- /.%65nv.local?v=YOXdM&_=IEM6ITsM
- /.env.txt?v=JdgJN&_=vEwlPmlG
- /%252Eenv?v=0f3Bv&_=PiKNNjQk
- /.env%00?v=lt2j0&_=LQvjRRN8
Sample User-Agents
- Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
- Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0
- Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1
- Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/24.0 Chrome/117.0.0.0 Mobile Safari/537.36
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36
What does this mean?
This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).
If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.