JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.40.11.3

13.40.11.3 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 46%: ?

46%

ISP	Amazon Data Services UK
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-40-11-3.eu-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇬🇧 United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.40.11.3

Whois 13.40.11.3

IP Abuse Reports for 13.40.11.3:

This IP address has been reported a total of 13 times from 11 distinct sources. 13.40.11.3 was first reported on June 15th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 derekgallardo01	2026-07-16 19:16:18 (2 days ago)	Auto-reported by Worker: AiTM toolkit UA fingerprint CRITICAL: auto-add to BadIPS Named Location + r ... show more Auto-reported by Worker: AiTM toolkit UA fingerprint CRITICAL: auto-add to BadIPS Named Location + report to AbuseIPDB.. Detection: AiTM toolkit UA fingerprint (Tycoon/EvilProxy portal-browser). Blocked at Conditional Access gate. show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-11 17:08:08 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.am ... show more (mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 13:08:05.247622 2026] [security2:error] [pid 12920:tid 12920] [client 13.40.11.3:46581] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 13.40.11.3 (+1 hits since last alert)\|troop9weymouth.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "troop9weymouth.com"] [uri "/xmlrpc.php"] [unique_id "alJ4dVhO6yrFi3Rcv5sNYQAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 18:24:23 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.am ... show more (mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 14:24:18.041981 2026] [security2:error] [pid 22569:tid 22649] [client 13.40.11.3:17780] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 13.40.11.3 (+1 hits since last alert)\|ccgparquitectos.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "ccgparquitectos.com"] [uri "/xmlrpc.php"] [unique_id "alE40oZzSVMWDX5DvDv4oQAAAJE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-10 18:21:25 (1 week ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇬🇧 contactcrm	2026-07-10 09:09:17 (1 week ago)	Form Spam : Form Spam	Web Spam
Anonymous	2026-07-08 17:38:14 (1 week ago)	[osotir.org] httpd-xmlrpc-post: sites=www.synathlountes.agonistes.gr; logs=/var/log/httpd/domains/ag ... show more [osotir.org] httpd-xmlrpc-post: sites=www.synathlountes.agonistes.gr; logs=/var/log/httpd/domains/agonistes.gr.synathlountes.log; samples=/xmlrpc.php show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 11:49:36 (1 week ago)	(mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.am ... show more (mod_security) mod_security (id:240335) triggered by 13.40.11.3 (ec2-13-40-11-3.eu-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 07:49:31.552828 2026] [security2:error] [pid 23001:tid 23001] [client 13.40.11.3:58241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 13.40.11.3 (+1 hits since last alert)\|milliondollarbelt.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "milliondollarbelt.com"] [uri "/xmlrpc.php"] [unique_id "akznyztr9q4oWVZuBxq5NgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 screwlooseit.com.au	2026-07-03 05:11:57 (2 weeks ago)	Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/ec2-13-40-11-3.eu-west-2.compute.amazonaw ... show more Blocked by CSF 13 firewall - Rule: XMLRPC US/United States/ec2-13-40-11-3.eu-west-2.compute.amazonaws.com show less	Web App Attack
🇫🇷 bazter.pro	2026-06-25 19:42:37 (3 weeks ago)	Fail2Ban: plesk-bot-aggressive - 15 failures	Port Scan Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-06-25 19:18:48 (3 weeks ago)	IM360 WAF: Rate limit exceeded for XMLRPC DoS	Web App Attack
🇺🇸 integrantservices.com	2026-06-25 18:44:17 (3 weeks ago)	(wordpress) Failed wordpress login from 13.40.11.3 (GB/United Kingdom/ec2-13-40-11-3.eu-west-2.compu ... show more (wordpress) Failed wordpress login from 13.40.11.3 (GB/United Kingdom/ec2-13-40-11-3.eu-west-2.compute.amazonaws.com) show less	Brute-Force
🇩🇪 EGP Abuse Dept	2026-06-16 02:45:18 (1 month ago)	Scanning for web/db/file exploits on brederaad-010.nl	SQL Injection Bad Web Bot Web App Attack
🇫🇷 Tilellit.PRO	2026-06-15 12:32:53 (1 month ago)	Fail2Ban banned 13.40.11.3 for security violations in jail wp-armour. Log: 2026/06/15 12:32:52 [erro ... show more Fail2Ban banned 13.40.11.3 for security violations in jail wp-armour. Log: 2026/06/15 12:32:52 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 13.40.11.3 \| Target: wplogin" , client: 13.40.11.3, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED] ... show less	Web Spam

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.149.218

🇭🇰 152.32.189.59

🇸🇬 104.248.151.49

🇧🇩 103.158.206.141

🇱🇹 81.30.98.47

🇺🇸 172.253.210.18

🇮🇩 163.227.52.50

🇺🇸 162.216.149.227

🇺🇸 162.216.150.215

🇷🇺 94.243.12.187

🇧🇷 45.182.70.144

🇺🇿 213.230.86.183

🇺🇸 209.90.232.26

🇷🇴 193.46.255.86

🇵🇰 182.185.136.247

🇵🇱 176.53.159.198

🇸🇬 119.13.106.88

🇺🇸 65.49.1.132

🇱🇺 64.89.160.112

🇬🇧 54.38.147.146