abuseip.org
- Reason
- suspicious paths across 1 domains
- Hits (last hour)
- 73
- Unique targets hit
- 1
- Unique paths probed
- 2,521
- Detection count
- 15
- First seen
- 2026-07-24 18:38:39 UTC
- Last seen
- 2026-07-24 19:47:33 UTC
- Block expires
- 2026-07-25 19:47:48 UTC
Sample paths probed
- /test/guinea-pig?throwError=watchTowrXSS58191%3C%2Fscript%3E%3Csvg+onload%3Dalert%28document.domain%29%3E
- /translate
- /examples/jsp/num/numguess.jsp?numGuesses=1&hint=%3Cscript%3Ealert(/watchTowr-3GxI1VVozuGCutDCbvYAPtb2OBU/)%3C%2Fscript%3E
- /private/validate_password_compliance
- /api/v3.1/faqs
- /cp?pid=-1&v=%7B%22enabled%22%3A0%2C%22type%22%3A%22alldays%22%2C%22name%22%3A%22%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%22%7D
- /rest/v1/rpc/invite_user_to_org
- /mcp
- /mcp/webhook-demo?userKey=watchTowr
- /rest/v1/rpc/transfer_app
- /jsin
- /rest/v1/rpc/get_total_metrics
- /
- /node-red-save?nr-url=http://d9ho7ftkdd2s69lf6pp0jharsk4pwhmma.dns.wt-oob-server.com&chng-sd=on&chng-wl=on
- /functions/v1/private/accept_invitation
- /admin2
- /view
- /api/v1/setup/test-downloader
- /login/esqueceu/
- /webhooks/webhook-demo/watchtowr.probe
Sample User-Agents
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
What does this mean?
This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).
If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.