JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.222.145.60

13.222.145.60 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-13-222-145-60.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.222.145.60

Whois 13.222.145.60

IP Abuse Reports for 13.222.145.60:

This IP address has been reported a total of 36 times from 21 distinct sources. 13.222.145.60 was first reported on September 15th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-09-17 21:59:10 (2 hours ago)	Auto-ban: >3000 req/min op 2026-09-17	Web App Attack SSH Hacking
🇧🇷 dominioz	2026-09-17 17:35:51 (7 hours ago)	2026-09-17 17:34:58 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64; ... show more 2026-09-17 17:34:58 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 301 474 2026-09-17 17:35:05 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 https://juliofantasma.com.br/.git/config 404 25813 2026-09-17 17:35:08 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 301 475 2026-09-17 17:35:09 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 http://juliofantasma.com.br/.git/config 301 474 2026-09-17 17:35:16 GET /.git/config - - 13.222.145.60 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 h ... show less	Web App Attack
🇺🇸 mnsf	2026-09-17 14:05:16 (10 hours ago)	Abuse Detected (29)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 07:50:52 (17 hours ago)	(mod_security) mod_security (id:949110) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amaz ... show more (mod_security) mod_security (id:949110) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 03:50:44.932633 2026] [security2:error] [pid 20085:tid 20085] [client 13.222.145.60:57488] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.delcano.org"] [uri "/wp-config.php.bak"] [unique_id "aqub1ImvQfE12z5_C1TbiAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 06:05:08 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amaz ... show more (mod_security) mod_security (id:210492) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 02:05:03.511288 2026] [security2:error] [pid 22884:tid 22884] [client 13.222.145.60:42228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paulshorrock.com"] [uri "/wp-config.php.bak"] [unique_id "aquDD5ZObXvRr-3gjT_Z4QAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-17 05:41:29 (19 hours ago)	TIPSDE WEBEXPLOIT 13.222.145.60 (ec2-13-222-145-60.compute-1.amazonaws.com)	Web App Attack
🇺🇸 kosada.com	2026-09-17 05:24:15 (19 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /wp-json/gravitysmtp/v1/tests/mock-d ... show more Repeated requests for suspicious nonexistent URLs, for example: /wp-json/gravitysmtp/v1/tests/mock-data (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36") show less	Web App Attack
🇳🇱 Alt255	2026-09-17 05:00:10 (19 hours ago)	[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ... show more [cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 13.222.145.60 - - [17/Sep/2026:07:00:05 +0200] "GET /.git/config HTTP/1.1" 403 7671 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 04:51:30 (20 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amaz ... show more (mod_security) mod_security (id:210492) triggered by 13.222.145.60 (ec2-13-222-145-60.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 00:51:22.498068 2026] [security2:error] [pid 16359:tid 16359] [client 13.222.145.60:60888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ink2wear.com"] [uri "/wp-config.php.bak"] [unique_id "aqtxytwlKpQtHyKiEfZPZAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-09-17 04:44:54 (20 hours ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.astropot.online \| URI: /.git/config \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇿🇦 conure.sh	2026-09-17 04:18:47 (20 hours ago)	csagent: score 19.9: wp-config backup grab x2, 404 noise floor x2; 1 domain(s) in 10s	Web App Attack
🇫🇷 masterguru	2026-09-17 04:09:15 (20 hours ago)	URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ... show more URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-197) show less	Hacking
Anonymous	2026-09-17 03:57:04 (20 hours ago)	Bot / scanning and/or hacking attempts: GET /.git/HEAD HTTP/1.1, GET /.env HTTP/1.1, GET /.env.local ... show more Bot / scanning and/or hacking attempts: GET /.git/HEAD HTTP/1.1, GET /.env HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.staging HTTP/1.1, GET /.env.backup HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.git/config HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.bak HTTP/1.1, GET / HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.old HTTP/1.1, GET /.git/index HTTP/1.1, GET /pathscan-465d2360f578-nope.env HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.save HTTP/1.1 show less	Hacking Web App Attack
🇸🇪 vaia.cloud	2026-09-17 03:40:03 (21 hours ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇷🇺 DZBOT	2026-09-17 03:31:07 (21 hours ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇽 200.68.183.225

🇧🇷 189.4.56.28

🇲🇾 47.254.230.4

🇵🇰 39.41.200.173

🇮🇹 34.17.96.246

🇮🇳 168.144.70.52

🇰🇷 152.32.243.193

🇺🇸 149.19.252.200

🇩🇪 146.103.40.9

🇺🇸 142.93.59.97

🇺🇸 136.108.76.188

🇻🇳 112.197.171.79

🇵🇱 95.214.53.157

🇺🇸 64.23.229.151

🇵🇰 59.103.239.69

🇧🇷 45.178.227.0

🇵🇪 38.250.161.87

🇩🇪 34.185.227.203

🇺🇸 3.131.24.55

🇺🇸 206.189.230.113