JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.126.253.239

13.126.253.239 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 48%: ?

48%

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-126-253-239.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.126.253.239

Whois 13.126.253.239

IP Abuse Reports for 13.126.253.239:

This IP address has been reported a total of 8 times from 7 distinct sources. 13.126.253.239 was first reported on July 29th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Mangelot Hosting	2026-07-29 08:54:06 (1 hour ago)	(modsecurity) srv101 ModSecurity 13.126.253.239 (IN/India/ec2-13-126-253-239.ap-south-1.compute.amaz ... show more (modsecurity) srv101 ModSecurity 13.126.253.239 (IN/India/ec2-13-126-253-239.ap-south-1.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇪🇸 alferez	2026-07-29 08:53:37 (1 hour ago)	Searching hacked php files	Hacking Exploited Host Web App Attack
Anonymous	2026-07-29 08:00:16 (2 hours ago)	Banned by Fail2Ban on server	Web App Attack
Anonymous	2026-07-29 07:40:16 (2 hours ago)	\| [Dangerous/India] Aggressive IP 13.126.253.239 (~30 hits). Type: DoS Defender- Web server 400 erro ... show more \| [Dangerous/India] Aggressive IP 13.126.253.239 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇫🇷 Octopuce	2026-07-29 07:38:06 (2 hours ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 07:10:27 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.126.253.239 (ec2-13-126-253-239.ap-south-1.c ... show more (mod_security) mod_security (id:210492) triggered by 13.126.253.239 (ec2-13-126-253-239.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 03:10:22.998385 2026] [security2:error] [pid 10706:tid 10706] [client 13.126.253.239:53952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ancientleather.com"] [uri "/.git/config"] [unique_id "ammnXpQPMaBa159TDMg47wAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 06:15:39 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.126.253.239 (ec2-13-126-253-239.ap-south-1.c ... show more (mod_security) mod_security (id:210492) triggered by 13.126.253.239 (ec2-13-126-253-239.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 02:15:33.691792 2026] [security2:error] [pid 3860854:tid 3860854] [client 13.126.253.239:35100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anchorroots.com"] [uri "/.git/config"] [unique_id "ammahXJbQrZMocFfLMrWlgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-29 04:39:19 (5 hours ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 167.71.222.255

🇳🇴 87.120.104.75

🇮🇩 36.64.68.99

🇺🇸 16.58.56.214

🇮🇳 223.185.50.28

🇩🇪 194.187.176.112

🇬🇭 179.64.71.68

🇪🇸 158.158.76.106

🇮🇳 106.201.76.203

🇮🇩 103.167.218.34

🇮🇩 103.130.167.198

🇩🇪 69.5.169.128

🇧🇷 45.205.1.247

🇵🇾 186.16.213.54

🇧🇷 177.70.145.11

🇩🇪 165.22.70.229

🇺🇸 151.197.221.107

🇹🇼 111.70.23.253

🇫🇷 91.231.89.131

🇫🇷 85.217.140.36