abuseip.org

IP 222.252.94.248 is currently blocked by the redirs.com anycast edge.

Reason: scanning 85 domains
Hits (last hour): 88
Unique targets hit: 86
Unique paths probed: 86
Detection count: 12
First seen: 2026-11-05 00:51:35 UTC
Last seen: 2026-11-05 00:53:12 UTC
Block expires: 2026-11-06 01:52:03 UTC

Sample paths probed

/wp-content/themes/100rojo/timthumb.php
/photos/14/14/39/square/mysteriousdes.jpg
/stxt/thumbs/1/0730/50036_1.jpg
/imagenes/reservar.png
/image/cache/data/Christian Louboutin Pumps/Christian Louboutin Open Lips 120mm Black Suede Peep Toe Pumps-150x150.jpg
/DESIGN-LEUCHTEN/images/product_images/thumbnail_images/487_0.jpg
/_assets/images_websites/105162.jpg
/hotlink/f2/a7/e2/e7/f8ad1d43ba82e07b511eaa8c605b2360.cache.015.jpg
/al/pressefachleute/fotothek/inscription/uploads/tx_menugraphaccueil/cal_04.jpg
/water-lightning-wallpapers_12923_1280x800.jpg
/jsm/_profile/P/Po/PoshCarolina/pimage3.jpg
/graphics/id/cs349-large.jpg
/files/Image/230001-231000/230685/278_thumb.jpg
/chickssportinggoods/pict/400298255860_1.jpg
/uploads/profile/photo-thumb-36179.jpg
/alben_sport/090502_VLN-Lauf3/thumbs/DSC_5061small.jpg
/mu/textilesinfomediary/logo/
/content/images/thumbs/0000447_125.jpg
/images/jackets/s/01/0199549141.jpg
/images/cat/articles.gif

Sample User-Agents

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36 OPR/54.0.2952.64
Mozilla/5.0 (X11; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64; rv:51.0.1) Gecko/20100101 Firefox/51.0.1
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 OPR/56.0.3051.99
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.2.0) Gecko/20100101 Firefox/52.2.0
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626 Safari/537.36 OPR/56.0.3051.36
Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/56.0.3051.52
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0.1) Gecko/20100101 Firefox/57.0.1
Mozilla/5.0 (Windows NT 6.0; Win64; x64; rv:66.0.5) Gecko/20100101 Firefox/66.0.5
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36 OPR/53.0.2907.106
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1; rv:65.0) Gecko/20100101 Firefox/65.0
Mozilla/5.0 (X11; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4; rv:65.0) Gecko/20100101 Firefox/65.0
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 OPR/54.0.2952.71
Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36 OPR/55.0.2994.44
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.62 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.