abuseip.org

IP 52.31.48.117 is currently blocked by the redirs.com anycast edge.

Reason: suspicious paths across 6 domains
Hits (last hour): 78
Unique targets hit: 6
Unique paths probed: 197
Detection count: 4
First seen: 2026-07-07 20:18:51 UTC
Last seen: 2026-07-07 20:29:06 UTC
Block expires: 2026-07-08 20:48:59 UTC

Sample paths probed

/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A03Z&OC-Signature=4799da529e94d55c8a2bbb8813aa872fd374781593ffda532669d3a66f2c814a
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A03Z&OC-Signature=af99867b9443d509c41651220dfbcc798c531aa6851290f49a06b8f9350da489
/?wcal_action=checkout_link&user_email=test&validate=DwOGaTRfTWpPR8S07YuXR5S2f3xB1xje6I8fznzzms/Lku7aNJqJRu6IeviWrnEg285N
/?wcal_action=checkout_link&user_email=test&validate=sAL4BTVfTWpn2pyKD6vc80aXuZ2cC8yhudScGu9Tun7kwbUN8jELMOAGJMkWkY6RqzTMgS6y
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A04Z&OC-Signature=26b3ac7c312686b2e6e5683456335b0c5daac834d93825ad9f63fda43f1359d9
/users/auth/saml/callback
/?wcal_action=checkout_link&user_email=test&validate=4QGlujZfTWrzqOUqsZdi1ESBwNcocoqsnZ7AVpDHLbcGLNsIrG9MBlktOl0+QS3H5GBC5KwXTQ==
/?wcal_action=checkout_link&user_email=test&validate=DwNWBzRfTWr+Ty3sBzCV9dMb5WNE07VAqUxeEUxyFUeDtOS/Sx2HyM0o2xTKrweaAApH
/?wcal_action=checkout_link&user_email=test&validate=sQKUfDVfTWqUAgtMfj4mCBg/4+ieO2v3AC2mnzlosfeFSTMZ//btR0Hs8M/NF/95ZbgkTxB5
/
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A03Z&OC-Signature=3cfd8660fec083a598b3d9f410d4051c9129d0ef555358421e704368661f20e0
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A04Z&OC-Signature=d694305092ad2b875057cbfb5d05ef78b54933ceee7c7c1fb4920e3c60b590e2
/?wcal_action=checkout_link&user_email=test&validate=4QGmFjZfTWq9Gso4z/Va400A/5oDi8qCp91TWLd+dKdT/VYhunkFC/ODbKsQ4omTF6aaOfL3dg==
/?wcal_action=checkout_link&user_email=test&validate=kgApCzJfTWp+p+YKcej0yfyG0bQoqvV+P4J6s0NY/SWYNssq0I1Z46cvGHqGm3puYUYnyNCjBA==
/remote.php/dav/files/admin?OC-Expires=991200&OC-Verb=PROPFIND&OC-Credential=admin&OC-Date=2026-07-07T20%3A19%3A03Z&OC-Signature=c195545726dde047a3e3f985e4f63e891636d2ec1b0588199b1a0d53595eea08
/?wcal_action=checkout_link&user_email=test&validate=nQOLxzJfTWoRdDWXIMVgtQu8N1DOpsrATfCwGawLCNWrlAg0FDZpzkBajw9kNicPSdDdcmaPploROg==
/?wcal_action=checkout_link&user_email=test&validate=qgKGlTNfTWppq0Gvxq0YyYC/fNxxSnCX+cBIu5hsMqXHAFf7krcFQhThi5dun8/xgO+x
/?wcal_action=checkout_link&user_email=test&validate=kgBknzJfTWry8IRw14R6m4JjFU5W7GaBNph+icLno8+SEFAkP3yA7njH8aHt5T1cDkblyZJb9g==
/?wcal_action=checkout_link&user_email=test&validate=qgLr6DNfTWplSINcBDg3mSZ4FXRCzSqb27w4TnBryWFrppBW8Jz+4Jww6H0f6cMJ8Y13
/?wcal_action=checkout_link&user_email=test&validate=ngMqEjJfTWq8njHoM6oNcEB0pzBXX7UBoaxTnx5iXe8pDu29ItJUyBi331dzzetAHBSQJuKT5xY+Ag==

Sample User-Agents

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 YaBrowser/25.4.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.6.5 Chrome/124.0.6367.243 Electron/30.1.2 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) obsidian/1.8.10 Chrome/132.0.6834.196 Electron/34.2.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15

What does this mean?

This address sent traffic that the redirs.com edge classified as automated abuse — typically WordPress/PHP exploit scanning, credential file probing (.env, .git, .aws/), or mass-domain enumeration. The block is automatic and time-limited (24 hours from last detection).

If you believe this is a false positive, contact [email protected] with the IP and the timestamps above.