abuseip.org

IP 20.9.28.111 is currently blocked by the redirs.com anycast edge.

Reason: scanning 30 domains
Hits (last hour): 4,930
Unique targets hit: 38
Unique paths probed: 190
Detection count: 37
First seen: 2026-06-25 08:00:57 UTC
Last seen: 2026-06-25 09:18:40 UTC
Block expires: 2026-06-26 09:20:24 UTC

Sample paths probed

/bks12.php
/w3lls.php
/this_is_a_new_hello_world.php
/won.php
/dccs.php
/xyn.php
/x.php
/adm1in.php
/wp-content/plugins/hellopress/wp_filemanager.php
/ccs.php
/security.php
/ccc.php
/meigui.php
/wp-ws68.php
/green3.php
/cc3.php
/bupa.php
/scxy.php
/sgettt.php
/FWAZ.php

Sample User-Agents

No User-Agent recorded (likely scripted, no UA header).

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.