abuseip.org

IP 158.23.85.214 is currently blocked by the redirs.com anycast edge.

Reason: scanning 45 domains
Hits (last hour): 5,937
Unique targets hit: 66
Unique paths probed: 362
Detection count: 16
First seen: 2026-11-01 14:11:17 UTC
Last seen: 2026-11-01 16:19:13 UTC
Block expires: 2026-11-02 16:19:29 UTC

Sample paths probed

/wp-admin/css/colors/coffee/colors.php
/wp-includes/fonts/search-template-1771419803.php
/wp-content/uploads/i99z7zzbwtpteujvv6s8hiCdefault.php
/wp-includes/class-wp-http-encoding-cron.php
/wp-admin/css/colors/blue/about.php
/wp-admin/includes/admin-filters-list-string.php
/wp-includes/bom.php
/wp-content/languages/8de90333369f3b.php
/.well-known/wp-trackback.php
/wp-admin/js/sdds.php
/wp-includes/css/well.php
/wp-content/uploads/wp-signup.php
/wp-content/uploads/rawr.php
/wp-includes/widgets/links-xml.php
/wp-includes/block-editor-double.php
/wp-admin/css/colors/ocean/addslashes.php
/wp-admin/css/AHntTlOm.php
/.well-known/1wvekeybd9it2di2vyipgr6Cdefault.php
/wp-includes/skpt.php
/wp-admin/includes/gettest.php

Sample User-Agents

No User-Agent recorded (likely scripted, no UA header).

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.