abuseip.org

IP 165.154.113.121 is currently blocked by the redirs.com anycast edge.

Reason: scanning 27 domains
Hits (last hour): 3,773
Unique targets hit: 27
Unique paths probed: 375
Detection count: 7
First seen: 2026-11-13 03:12:43 UTC
Last seen: 2026-11-13 03:17:44 UTC
Block expires: 2026-11-14 03:53:03 UTC

Sample paths probed

/360.html
/js/app.js
/ay-1.html
/100000/apk
/code1.html
/api/pub/1
/js/conf.js
/home.json
/categories
/app-zlfh/
/index/aurl
/api?code=1
/api/events
/index.html
/
/style.css
/config.js
/api/config
/vip
/js/home.js

Sample User-Agents

Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/115.7 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (Linux; Android 14; SM-G930U; Build/UD1A.230513.124) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.3124.41 Mobile Safari/537.36 EdgA/134.0.3124.41
Mozilla/5.0 (Linux; Android 15; SM-G800H; Build/AP3A.180106.164) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.2365.20 Mobile Safari/537.36 EdgA/122.0.2365.20
Mozilla/5.0 (Android 8; Mobile; rv:115.0.0) Gecko/115.0.0 Firefox/115.0.0
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/140.0 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (Linux; Android 12; SM-G935V; Build/SD1A.180607.50) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.123 Mobile Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 15_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/133.0.6943.210 Mobile/15E148 Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 14 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/115.3 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/133.0.6943.210 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 12; Mi 9 Pro 5G; Build/SP2A.240105.157) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.105 Mobile Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/136.0.7103.180 Mobile/15E148 Safari/537.36
curl/7.4.0
Mozilla/5.0 (Android 14; Mobile; rv:136.0.0) Gecko/136.0.0 Firefox/136.0.0
Mozilla/5.0 (Linux; Android 15; Redmi Note 10; Build/AP3A.240001.215) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.151 Mobile Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Mozilla/5.0 (Linux; Android 14; Redmi Note 14 5G; Build/AP2A.250024.73) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.1938.25 Mobile Safari/537.36 EdgA/116.0.1938.25
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/112.0.1722.6 Mobile/15E148 Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/134.0.3124.44 Mobile/15E148 Safari/537.36
okhttp/3.14.9
Mozilla/5.0 (Linux; Android 15; PEEM00; Build/AP4A.250704.32) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.1901.83 Mobile Safari/537.36 EdgA/115.0.1901.83

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.