abuseip.org

IP 3.252.204.238 is currently blocked by the redirs.com anycast edge.

Reason: suspicious paths across 12 domains
Hits (last hour): 156
Unique targets hit: 12
Unique paths probed: 252
Detection count: 11
First seen: 2026-06-22 06:32:39 UTC
Last seen: 2026-06-22 06:32:59 UTC
Block expires: 2026-06-23 07:28:10 UTC

Sample paths probed

/?wcal_action=checkout_link&user_email=test&validate=nAPDTQjXOGo6Iu9d9sZRnTj9Tg1CX924QAbrEi6sCcVwEhp9T0EBi3n4Ru+EaS0OOzlufubQuMOHg4AHyjU=
/axis2-admin/login
/?wcal_action=checkout_link&user_email=test&validate=NQM6RQjXOGrGW+6vpcH/NLNDPu3Fn86/W20qcIoDQ18swyu5VxykRGD//JQnIjhIOTcqsXkU1bCu7jddww==
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A40Z&OC-Signature=90d87c77b201297c78222e1fdc35097909b2ca6f15c418d9e32b011b61f81916
/index.php
/?wcal_action=checkout_link&user_email=test&validate=XwG+fAjXOGr0WyYl4m1c9pZ333lC/pLwaNgLLp0IuIC+z09PL5ij+sBN15Vk/MHUoMfCAueroTGMJi//qWk=
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A40Z&OC-Signature=445cc0d8bbaac0dadbed65d03c4fd4b57bc2e81d04c212473a0cc6e7543837fb
/users/auth/saml/callback
/?wcal_action=checkout_link&user_email=test&validate=FABCRQrXOGqwm528pzxlSLPaNToaJSmQ3ZGkrOLOaQ+/xNbr7SBcokNxsndh7xQko2SU72BeO5tsMguyFA==
/?wcal_action=checkout_link&user_email=test&validate=lwBbuQnXOGr6h5cwkiQpE9BVq9u10aATG+PYSzsjZL/cdax2jZig0i3+4geaVfFq71jjna7Fmdnw
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A41Z&OC-Signature=31a26c118c3b39641889ebb435392048321062618ddf33004ae63f7cc2f0ba73
/?wcal_action=checkout_link&user_email=test&validate=lALq2QjXOGruSX3znXn2Cef3CZv54O9J7ExrmBov+OIboCGTzaxDmhI29prblLjhJVRLULMhon+QL/o8
/axis2/axis2-admin/login
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A40Z&OC-Signature=00ff14ad188d2cc8464f37841f5bd997fba39387e823d7de003556c429594e64
/?wcal_action=checkout_link&user_email=test&validate=9QKojQjXOGplSZHiOrUl8+zjKGJ4LJJSUum44CmxS0CaXw323ky9g8psQPGazcxfJjX1AZI=
/
/?wcal_action=checkout_link&user_email=test&validate=aADqEQnXOGo+UR1ra868DNMq2s8CxeYcGj8M0n88yrbgHvYKBDJoZzYP5gls/t4YtjVvc/omLQ==
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A41Z&OC-Signature=812240a693294c82875da52cdc68eb4a4dac07f47dcb0a3be8e980752cda15c5
/?wcal_action=checkout_link&user_email=test&validate=XQE5YwjXOGqbsIzfnZ0oMWxH89FqjjvzjaXrkLMtR4O/g1iOorCxZnh9ZDcSKPvUlbt1MMUGQ9er5RAH
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-06-22T06%3A32%3A41Z&OC-Signature=905d8258fee7caa532ae9915ff22db71690ac4ba05f2e8e7bf6612ffbf806465

Sample User-Agents

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.8.10 Chrome/132.0.6834.196 Electron/34.2.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.6.5 Chrome/124.0.6367.243 Electron/30.1.2 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.