JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

13.48.84.65

Neutral Activity

Abuse confidence score ?

0% Low Risk

29 reports

20 reporters · latest 1 year ago

ISP	Amazon Data Services Sweden
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-48-84-65.eu-north-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

13.48.84.65 has been reported 29 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 13.48.84.65

This IP address has been reported a total of 29 times from 20 distinct sources. 13.48.84.65 was first reported on January 18th 2025, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2025-01-20 01:47:15 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute ... show more (mod_security) mod_security (id:210730) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 19 20:47:10.275579 2025] [security2:error] [pid 19090:tid 19090] [client 13.48.84.65:54484] [client 13.48.84.65] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.curriculum-web.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.curriculum-web.com"] [uri "/config/php.ini"] [unique_id "Z42rHmab5fzAmLK0GaV5FgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 theblocker	2025-01-20 01:41:04 (1 year ago)	Hacking Attempts	Hacking Brute-Force
🇫🇷 security.yc3a.com	2025-01-20 00:15:05 (1 year ago)	13.48.84.65 - - [20/Jan/2025:00:15:04 +0000] "GET /admin/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 ( ... show more 13.48.84.65 - - [20/Jan/2025:00:15:04 +0000] "GET /admin/config HTTP/1.1" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-01-20 00:07:38 (1 year ago)	(mod_security) mod_security (id:210730) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute ... show more (mod_security) mod_security (id:210730) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 19 19:07:31.925071 2025] [security2:error] [pid 18475:tid 18475] [client 13.48.84.65:62626] [client 13.48.84.65] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.powerkiteforum.com\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.powerkiteforum.com"] [uri "/config/php.ini"] [unique_id "Z42TwxDZTArVQVQFnaCcYAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2025-01-19 22:32:29 (1 year ago)	13.48.84.65 - - [20/Jan/2025:00:32:26 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Lin ... show more 13.48.84.65 - - [20/Jan/2025:00:32:26 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Web App Attack
🇲🇾 Rizzy	2025-01-19 21:43:33 (1 year ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇨🇦 Mediashaker	2025-01-19 21:35:11 (1 year ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 13.48.84.65 (SE/Sweden/e ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 13.48.84.65 (SE/Sweden/ec2-13-48-84-65.eu-north-1.compute.amazonaws.com) show less	Port Scan
🇵🇱 rafix	2025-01-19 21:21:00 (1 year ago)	13.48.84.65 424344 - - [19/Jan/2025:22:21:58 +0100] "GET /admin/test HTTP/1.1" 404 196 "-" "Mozilla/ ... show more 13.48.84.65 424344 - - [19/Jan/2025:22:21:58 +0100] "GET /admin/test HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-01-19 20:35:14 (1 year ago)	(mod_security) mod_security (id:243320) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute ... show more (mod_security) mod_security (id:243320) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 19 15:35:07.058330 2025] [security2:error] [pid 26733:tid 26733] [client 13.48.84.65:60759] [client 13.48.84.65] ModSecurity: Access denied with code 403 (phase 2). String match "/.profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6621"] [id "243320"] [rev "1"] [msg "COMODO WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)\|\|lmga.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lmga.net"] [uri "/.profile"] [unique_id "Z41h-3Z7v6CV1orsQyPyOwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 [email protected]	2025-01-19 20:33:28 (1 year ago)	Brute force 144 attempts	DDoS Attack SQL Injection Brute-Force SSH
🇺🇦 URAN Publishing Service	2025-01-19 20:18:27 (1 year ago)	13.48.84.65 - - [19/Jan/2025:22:18:26 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Lin ... show more 13.48.84.65 - - [19/Jan/2025:22:18:26 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Web App Attack
🇧🇪 cmbplf	2025-01-19 19:43:32 (1 year ago)	152 requests to *.env	Brute-Force Bad Web Bot
🇨🇦 polycoda	2025-01-19 19:36:00 (1 year ago)	📄 Probes for tons of inexistent files and PHP scripts	Hacking Web App Attack
🇮🇩 Burayot	2025-01-19 19:17:30 (1 year ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 13.48.84.65 (SE/Sweden/ec2-13-48-84- ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 13.48.84.65 (SE/Sweden/ec2-13-48-84-65.eu-north-1.compute.amazonaws.com): 2 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2025-01-19 18:06:08 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute ... show more (mod_security) mod_security (id:210492) triggered by 13.48.84.65 (ec2-13-48-84-65.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 19 13:06:02.437988 2025] [security2:error] [pid 15163:tid 15163] [client 13.48.84.65:53817] [client 13.48.84.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "manaplas.com"] [uri "/.env"] [unique_id "Z40_CnHxsVGgU8RCByMJLwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 210.100.159.253

🇧🇷 187.102.181.222

🇺🇸 173.244.60.241

🇫🇮 147.185.133.213

🇨🇳 116.62.243.75

🇧🇩 103.197.153.88

🇳🇱 91.92.47.252

🇺🇸 70.183.226.54

🇳🇱 45.148.10.123

🇮🇹 5.91.216.32

🇲🇦 196.92.7.247

🇳🇱 195.178.110.30

🇬🇧 193.163.125.244

🇷🇴 193.32.162.36

🇧🇴 190.181.25.210

🇮🇳 164.100.5.203

🇺🇸 147.185.132.178

🇮🇳 139.5.242.86

🇨🇳 117.50.122.20

🇷🇺 92.240.221.198