abuseip.org
- Reason
- suspicious paths across 1 domains
- Hits (last hour)
- 814
- Unique targets hit
- 11
- Unique paths probed
- 8,492
- Detection count
- 12
- First seen
- 2026-10-14 16:54:01 UTC
- Last seen
- 2026-10-14 17:15:55 UTC
- Block expires
- 2026-10-15 18:13:35 UTC
Sample paths probed
- /glpi/plugins/barcode/front/send.php
- /_vti_bin/shtml.dll/_vti_rpc
- /ui/vropspluginui/rest/services/uploadova
- /sdk
- /go/add-on/business-continuity/api/plugin
- /loginLess/../../etc/passwd
- /login
- /gitdata/index
- /nmaplowercheck1791996929
- /../../../../etc/passwd
- /evox/about
- /
- /HNAP1
- /nice ports,/Trinity.txt.bak
- /robots.txt
- /analytics/telemetry/ph/api/hyper/send
- /getCorsFile
- /.git/index
- /console/css/%2e%2e%2fconsolejndi.portal
- /../../etc/passwd
Sample User-Agents
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.8.25
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
- Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.96 Safari/537.36
- Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
- Mozilla/5.0 (Windows NT 6.1; Win64; x64)
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/120.0.0.0 Safari/537.36
- Mozilla/5.0 (Macintosh; Intel Mac OS X 14.1) AppleWebKit/618.27 (KHTML, like Gecko) Version/17.4 Safari/618.27
- vAPI/2.100.0 Java/1.8.0_261 (Linux; 4.19.160-6.ph3; amd64)
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.8.24
- python-requests/2.28.1
- Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
- Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
- Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
- Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
- Mozilla/5.0 (Knoppix; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0
- Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
- Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
- Mozilla/5.0 (Knoppix; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0
- Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:128.0) Gecko/20100101 Firefox/128.0
What does this mean?
This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).
If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.