abuseip.org

IP 165.154.113.21 is currently blocked by the redirs.com anycast edge.

Reason: scanning 31 domains
Hits (last hour): 2,386
Unique targets hit: 31
Unique paths probed: 379
Detection count: 11
First seen: 2026-11-13 03:12:41 UTC
Last seen: 2026-11-13 03:17:10 UTC
Block expires: 2026-11-14 04:08:05 UTC

Sample paths probed

/land.html
/100000/apk
/code1.html
/api/pub/1
/data/json/config.json
/js/conf.js
/categories
/index/aurl
/api?code=1
/api/events
/index.html
/js/base1.js
/yongxing/
/static/diff_worker.js
/api/health
/js/a.script
/api/config
/js/post.js/
/api/user/ismustmobile
/js/home.js

Sample User-Agents

Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (Linux; Android 10; SM-G3606; Build/QD1A.240818.183) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.3 Mobile Safari/537.36
Mozilla/5.0 (Android 8; Mobile; rv:134.0.1) Gecko/134.0.1 Firefox/134.0.1
Mozilla/5.0 (iPhone; CPU iPhone OS 14_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/134.0 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/116.0.1938.41 Mobile/15E148 Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0 Mobile/15E148 Safari/602.4.8
Mozilla/5.0 (Linux; Android 8; SM-G920K; Build/OPR2.170723.244) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.181 Mobile Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/136.0.7103.117 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 12; Redmi Note 9T 5G; Build/SP1A.250124.39) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.65 Mobile Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/116.0.1938.65 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 11; SM-G9600; Build/RQ3A.170812.155) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6834.65 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 8; Redmi 13C 5G; Build/OPD1.250523.174) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.99 Mobile Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/129.0.2792.59 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 9; Black Shark 5 Pro; Build/PQ3B.231126.67) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.1901.49 Mobile Safari/537.36 EdgA/115.0.1901.49
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/112.0 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/130.0.2849.58 Mobile/15E148 Safari/537.36
okhttp/3.14.9
Mozilla/5.0 (iPhone; CPU iPhone OS 14_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/122.0 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/107.0.1418.64 Mobile/15E148 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.