abuseip.org

home · sitemap

Public registry of IP addresses currently blocked by the redirs.com anycast edge for automated abuse — credential scanning, WordPress/PHP exploit probing, and mass-domain enumeration.

Blocked IPs: 872
Total recent hits: 323,411
Last refresh: 2026-07-31 04:21:46 UTC
Block duration: 24 hours from last detection

How to look up an IP

Visit https://abuseip.org/ip/<address>. For example: https://abuseip.org/ip/172.69.166.86.

The full list of blocked IPs is in the sitemap.

Bulk export

Machine-readable feeds, regenerated hourly:

/blocklist.txt — one IP per line, suitable for firewalls / fail2ban / ipset
/blocklist.json — full structured records (reason, hits, timestamps, sample paths)
/blocklist.xml — same data as XML

Customer hostnames are intentionally omitted from all exports.

Recent detections

135.119.63.61 — scanning 162 domains (5,881 hits)
20.113.56.22 — scanning 32 domains (1,218 hits)
20.63.98.115 — suspicious paths across 16 domains (1,402 hits)
20.104.16.169 — scanning 99 domains (5,103 hits)
172.213.232.128 — suspicious paths across 19 domains (384 hits)
159.65.1.163 — suspicious paths across 22 domains (1,396 hits)
2600:3c15::2000:c8ff:fe38:e857 — suspicious paths across 8 domains (1,106 hits)
94.154.43.177 — scanning 26 domains (29 hits)
91.92.241.196 — scanning 152 domains (208 hits)
94.154.43.229 — scanning 34 domains (34 hits)
20.104.22.47 — scanning 67 domains (6,485 hits)
127.0.0.1 — scanning 52 domains (13,864 hits)
34.148.22.62 — suspicious paths across 9 domains (217 hits)
20.215.216.94 — scanning 38 domains (4,120 hits)
52.165.196.84 — scanning 47 domains (9,601 hits)
20.48.234.177 — scanning 46 domains (8,233 hits)
20.197.178.120 — scanning 49 domains (9,043 hits)
84.17.60.251 — scanning 211 domains (2,316 hits)
20.9.4.9 — scanning 63 domains (6,486 hits)
85.204.70.116 — scanning 60 domains (660 hits)
2a06:98c0:3600::103 — scanning 31 domains (40 hits)
34.82.8.192 — suspicious paths across 2 domains (120 hits)
136.66.183.204 — suspicious paths across 2 domains (119 hits)
159.89.206.122 — suspicious paths across 2 domains (868 hits)
185.93.89.147 — scanning 153 domains (153 hits)

Removal & contact

Blocks expire automatically 24 hours after the last detected hit. For false-positive reports email [email protected] with the IP and the relevant timestamps.