JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.250.26.138

13.250.26.138 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 70%: ?

70%

ISP	Amazon Data Services Singapore
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.250.26.138

Whois 13.250.26.138

IP Abuse Reports for 13.250.26.138:

This IP address has been reported a total of 18 times from 13 distinct sources. 13.250.26.138 was first reported on November 21st 2025, and the most recent report was 23 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-27 14:43:05 (23 hours ago)	[MonJul2716:43:01.3784712026][security2:error][pid881641:tid881948][client13.250.26.138:0]ModSecurit ... show more [MonJul2716:43:01.3784712026][security2:error][pid881641:tid881948][client13.250.26.138:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$$\(41\271$\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require$child_process$.execsync$echo\$\(\(41\271$\)\\|base64-w0\).tostring.trimthrowobject.assign$newerror\(next_redirect${digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"npdesign360.ch\"][uri\"/\"][unique_id\"amdudZbPWHocjGLNcMh0zQAAAZE\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 12:37:53 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 08:37:50.328539 2026] [security2:error] [pid 829501:tid 829501] [client 13.250.26.138:36668] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noxiousthoughts.com"] [uri "/.git/config"] [unique_id "amdRHgQpMeEBrjOj8dEIsAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-25 19:49:09 (2 days ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇺🇸 mnsf	2026-07-25 16:05:13 (2 days ago)	Abuse Detected (9)	Brute-Force Web App Attack
Anonymous	2026-07-25 09:54:24 (3 days ago)	(caddyscan) Scanner path probe from 13.250.26.138 (SG/Singapore/ec2-13-250-26-138.ap-southeast-1.com ... show more (caddyscan) Scanner path probe from 13.250.26.138 (SG/Singapore/ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 13.250.26.138 - - [25/Jul/2026:09:54:21 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 13.250.26.138 - - [25/Jul/2026:09:54:21 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 13.250.26.138 - - [25/Jul/2026:09:54:21 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 13.250.26.138 - - [25/Jul/2026:09:54:22 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 13.250.26.138 - - [25/Jul/2026:09:54:22 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇩🇪 LRob	2026-07-25 04:52:54 (3 days ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5. ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Hacking
🇳🇱 homeshowdomain.nl	2026-07-24 22:02:48 (3 days ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇨🇭 4server	2026-07-24 20:16:05 (3 days ago)	[FriJul2422:16:02.5774622026][security2:error][pid646756:tid646938][client13.250.26.138:0]ModSecurit ... show more [FriJul2422:16:02.5774622026][security2:error][pid646756:tid646938][client13.250.26.138:0]ModSecurity:Accessdeniedwithcode403$phase1$.Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.carolin-mizio.ch.81-17-25-250.cpanel.site\"][uri\"/.git/config\"][unique_id\"amPIAnLZs81BI7xEtInMwgAAAQ8\"] show less	Hacking Web App Attack
🇳🇱 e.fierstra	2026-07-24 18:56:14 (3 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-07-24 17:05:09 (3 days ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (82/60 min)'; Requests=82	Port Scan
🇮🇹 VHosting	2026-07-24 15:45:03 (3 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇮🇩 Burayot	2026-07-24 14:13:40 (3 days ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 13.250.26.138 (SG/Singapore/ec2-13- ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 13.250.26.138 (SG/Singapore/ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 11:20:24 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 07:20:15.945274 2026] [security2:error] [pid 3898825:tid 3898825] [client 13.250.26.138:37242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.caribbeantanz.postermodelsworldwideinc.com"] [uri "/.git/config"] [unique_id "amNKb3TbABwL0aWF_dghbgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 06:55:44 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:55:41.539310 2026] [security2:error] [pid 269020:tid 269058] [client 13.250.26.138:37328] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.caregiversregistry.richardleeweatherman.com"] [uri "/.git/config"] [unique_id "amMMbaQ0ocjb3hrZgbTjnAAAAYY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 06:05:55 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 13.250.26.138 (ec2-13-250-26-138.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:05:48.629752 2026] [security2:error] [pid 18380:tid 18380] [client 13.250.26.138:41024] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.careers.evolute.io"] [uri "/.git/config"] [unique_id "amMAvGwdY0DnXnL_4e6qPwAAACs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a09:bac5:6d1b:323c::501:63

🇹🇼 198.235.24.71

🇳🇱 195.178.110.137

🇹🇼 128.14.227.52

🇷🇺 94.243.14.202

🇧🇩 43.250.80.154

🇸🇳 41.208.147.131

🇨🇳 218.205.34.19

🇺🇸 74.50.65.123

🇸🇾 5.155.2.189

🇺🇸 206.81.7.82

🇮🇳 182.70.255.242

🇨🇱 181.161.141.100

🇮🇹 172.213.216.126

🇮🇳 157.49.140.244

🇺🇸 148.72.64.140

🇹🇷 94.154.43.178

🇩🇪 93.152.221.206

🇺🇸 40.119.41.182

🇺🇸 35.188.112.111