abuseip.org

IP 165.154.94.115 is currently blocked by the redirs.com anycast edge.

Reason: scanning 49 domains
Hits (last hour): 9,001
Unique targets hit: 49
Unique paths probed: 378
Detection count: 12
First seen: 2026-11-13 03:15:54 UTC
Last seen: 2026-11-13 03:20:14 UTC
Block expires: 2026-11-14 04:13:06 UTC

Sample paths probed

/xy/image/jiantou.png
/TikTok/TikTok.html
/images/banks/zs.png
/api/app/indexList
/lottery/common.js
/api/chat/messages
/mobile/index/home
/
/mobile/preference
/pub-api-2/healthy
/Tpl/qrcode.min.js
/kdata/selectMqUrl
/api/uploads/apimap
/static/css/style.css
/api/app/home-config
/api/Home/videoNew
/api/appSetting.do
/API/Web/chat.ashx
/api/Ad/getAdByTag
/public/css/style.css

Sample User-Agents

Mozilla/5.0 (Android 12; Mobile; rv:115.4.0) Gecko/115.4.0 Firefox/115.4.0
Mozilla/5.0 (Linux; Android 13; Redmi Note 7S; Build/TQ1A.241127.151) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.7204.169 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 9; SM-G9508; Build/PPR2.180922.230) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.3296.26 Mobile Safari/537.36 EdgA/137.0.3296.26
Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/115.2 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (Linux; Android 11; Pixel 7 Pro; Build/RQ1C.211020.111) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.2849.66 Mobile Safari/537.36 EdgA/130.0.2849.66
Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/133.0.6943.18 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Android 11; Mobile; rv:124.0.1) Gecko/124.0.1 Firefox/124.0.1
Mozilla/5.0 (iPhone; CPU iPhone OS 16_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/122.0.2365.23 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 14; CPH1941; Build/UD1A.251122.60) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.243 Mobile Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 15_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.0 EdgiOS/111.0.1661.17 Mobile/15E148 Safari/537.36
Mozilla/5.0 (Linux; Android 12; Redmi A2; Build/SD2A.230228.69) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.7049.80 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 15; SM-G925X; Build/AP3A.220600.138) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.129 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 14; SM-318MZ; Build/AP2A.240816.48) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.235 Mobile Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/116.0 Mobile/15E148 Safari/605.1.15
Mozilla/5.0 (Android 10; Mobile; rv:115.6.0) Gecko/115.6.0 Firefox/115.6.0
Mozilla/6.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Mozilla/5.0 (Linux; Android 8; Redmi 11 Prime; Build/OPD2.241100.34) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.1185.23 Mobile Safari/537.36 EdgA/100.0.1185.23
okhttp/3.14.9
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) CriOS/104.0.5112.204 Mobile/15E148 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.