JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.238.161.48

13.238.161.48 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 54%: ?

54%

ISP	Amazon Corporate Services Pty Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-238-161-48.ap-southeast-2.compute.amazonaws.com
Domain Name	amazon.com.au
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.238.161.48

Whois 13.238.161.48

IP Abuse Reports for 13.238.161.48:

This IP address has been reported a total of 11 times from 8 distinct sources. 13.238.161.48 was first reported on July 24th 2026, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-27 15:45:24 (19 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2 ... show more (mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 11:45:18.594736 2026] [security2:error] [pid 1254576:tid 1254576] [client 13.238.161.48:45584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fanarch.xyz"] [uri "/.git/config"] [unique_id "amd9DjTGFG6Nkmp0VebPBwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 pipeline.es	2026-07-27 13:30:27 (21 hours ago)	Web scanning / probing for vulnerable paths \| URL: /notifications/.env \| Evidence: familytour.tur.br ... show more Web scanning / probing for vulnerable paths \| URL: /notifications/.env \| Evidence: familytour.tur.br 13.238.161.48 - - [27/Jul/2026:15:29:32 +0200] \"GET /notifications/.env HTTP/1.1\" 404 17937 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" GEOIP_COUNTRY_CODE=AU \| ASN: AMAZON-02 \| Country: AU show less	Port Scan Web App Attack
🇺🇦 URAN Publishing Service	2026-07-27 12:20:53 (22 hours ago)	13.238.161.48 - - [27/Jul/2026:15:20:50 +0300] "GET /.git/config HTTP/1.1" 404 705 "-" "Mozilla/5.0 ... show more 13.238.161.48 - - [27/Jul/2026:15:20:50 +0300] "GET /.git/config HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 13.238.161.48 - - [27/Jul/2026:15:20:52 +0300] "GET /.env HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 09:53:04 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2 ... show more (mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 05:52:56.255762 2026] [security2:error] [pid 159698:tid 159698] [client 13.238.161.48:38558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "family.amgtr.com"] [uri "/.git/config"] [unique_id "amcqePl18FvrgEE_4QL4yQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 infra-monitor	2026-07-25 17:00:06 (2 days ago)	Automated ban via infra-monitor: suspicious-probe	Port Scan
🇺🇸 TPI-Abuse	2026-07-25 12:29:26 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2 ... show more (mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 08:29:20.550781 2026] [security2:error] [pid 15969:tid 15969] [client 13.238.161.48:33034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "magazine.angelabcomics.com"] [uri "/.git/config"] [unique_id "amSsIJb9E8dWkq_9EG3e2wAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-24 22:01:03 (3 days ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇩🇪 LRob	2026-07-24 20:46:53 (3 days ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5. ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Hacking
🇺🇸 TPI-Abuse	2026-07-24 13:06:02 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2 ... show more (mod_security) mod_security (id:210492) triggered by 13.238.161.48 (ec2-13-238-161-48.ap-southeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 09:05:58.154414 2026] [security2:error] [pid 4143989:tid 4143989] [client 13.238.161.48:45658] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lunchtimers.org"] [uri "/.git/config"] [unique_id "amNjNjVmSvlPILO3IGqEAQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-07-24 10:45:03 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
Anonymous	2026-07-24 06:30:29 (4 days ago)	\| [Dangerous/Australia] Aggressive IP 13.238.161.48 (~30 hits). Type: DoS Defender- Web server 400 e ... show more \| [Dangerous/Australia] Aggressive IP 13.238.161.48 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 209.242.192.245

🇩🇪 207.154.239.237

🇳🇱 172.94.9.222

🇺🇸 161.153.120.130

🇨🇦 138.197.147.76

🇨🇳 124.223.206.254

🇭🇰 103.210.21.242

🇺🇸 98.58.154.60

🇺🇸 91.230.168.75

🇹🇼 60.251.229.144

🇨🇳 58.210.7.34

🇩🇪 47.245.139.141

🇺🇸 20.169.106.209

🇺🇸 216.25.89.73

🇹🇷 185.153.231.44

🇮🇳 183.87.217.222

🇵🇱 176.53.159.198

🇩🇪 164.90.234.39

🇹🇼 128.14.237.43

🇵🇰 103.152.100.203