JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 16.148.193.239

16.148.193.239 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 67%: ?

67%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-16-148-193-239.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 16.148.193.239

Whois 16.148.193.239

IP Abuse Reports for 16.148.193.239:

This IP address has been reported a total of 16 times from 15 distinct sources. 16.148.193.239 was first reported on July 17th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 service Informatique	2026-09-02 04:00:37 (2 hours ago)	HEAD /epa/scripts	Web App Attack
🇵🇾 armandosaucedo.me	2026-09-01 05:44:58 (1 day ago)	Threat Intelligence via ARMTI, Web Attack: HEAD /epa/scripts/win/nsepa_setup.exe	Web App Attack
🇺🇸 xxkodedxx	2026-09-01 05:13:16 (1 day ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: US / AS16509 Amazon.com, Inc. Active: 05:12:47 UTC Volume: 1 HTTP req Probed: /epa/scripts/win/nsepa_setup.exe Status mix: 444×1 Vhost fishing: 67.217.240.72 UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇦🇺 2000cn.com.au	2026-09-01 05:10:01 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇺🇸 donarev419	2026-09-01 04:54:30 (1 day ago)	Connection to port 443 with data transfer. Data preview: �	Port Scan Hacking
🇯🇵 pixelboost.kr	2026-09-01 04:26:14 (1 day ago)	16.148.193.239 - - [01/Sep/2026:13:26:14 +0900] "HEAD /epa/scripts/win/nsepa_setup.exe HTTP/1.1" 444 ... show more 16.148.193.239 - - [01/Sep/2026:13:26:14 +0900] "HEAD /epa/scripts/win/nsepa_setup.exe HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇩🇪 hero2026	2026-09-01 01:53:25 (1 day ago)	Blocked by Fail2ban	Web App Attack
🇺🇸 cwytech	2026-09-01 01:45:37 (1 day ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tactical-rmm-lockdown-high.	Hacking
Anonymous	2026-09-01 01:18:07 (1 day ago)	Unauthorised traffic to honeypot	Port Scan
🇫🇷 vtchost.com	2026-09-01 01:09:50 (1 day ago)	minux.cc:443 16.148.193.239 - - [01/Sep/2026:03:09:50 +0200] "HEAD /epa/scripts/win/nsepa_setup.exe ... show more minux.cc:443 16.148.193.239 - - [01/Sep/2026:03:09:50 +0200] "HEAD /epa/scripts/win/nsepa_setup.exe HTTP/1.1" 418 4108 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" ... show less	Web App Attack
🇳🇱 DrLex0	2026-09-01 00:41:57 (1 day ago)	Probing for various exploits 16.148.193.239 443 - [01/Sep/2026:00:41:57 +0000] "HEAD /epa/scripts/w ... show more Probing for various exploits 16.148.193.239 443 - [01/Sep/2026:00:41:57 +0000] "HEAD /epa/scripts/win/nsepa_setup.exe HTTP/1.1" 404 5340 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-07-17 22:45:04 (1 month ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 21:35:04 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 16.148.193.239 (ec2-16-148-193-239.us-west-2.co ... show more (mod_security) mod_security (id:210492) triggered by 16.148.193.239 (ec2-16-148-193-239.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 17:34:58.374010 2026] [security2:error] [pid 18638:tid 18642] [client 16.148.193.239:41042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.surdick.com"] [uri "/wp-config.php.bak"] [unique_id "alqgApFyfqQWtIxlodl0_gAAAMI"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-07-17 21:27:36 (1 month ago)	[FriJul1723:27:32.7186742026][security2:error][pid1875111:tid1875281][client16.148.193.239:0]ModSecu ... show more [FriJul1723:27:32.7186742026][security2:error][pid1875111:tid1875281][client16.148.193.239:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"cpanel.labaita-lanzo.it\"][uri\"/.env\"][unique_id\"alqeRKQs3xJ62_1kzK7VzQAAAI0\"] show less	Hacking Web App Attack
🇲🇾 Rizzy	2026-07-17 20:28:22 (1 month ago)	Multiple WAF Violations	Brute-Force Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.176.29.5

🇨🇳 58.242.60.246

🇨🇳 221.200.71.31

🇨🇱 179.60.74.195

🇸🇬 172.217.32.150

🇺🇸 162.216.150.199

🇺🇸 147.185.132.243

🇻🇳 103.9.204.206

🇧🇩 103.7.113.154

🇺🇸 91.230.168.50

🇺🇸 66.132.172.45

🇺🇸 65.49.1.176

🇺🇸 45.33.95.64

🇮🇩 36.83.52.8

🇺🇸 35.237.94.18

🇨🇭 34.65.1.222

🇺🇸 20.172.67.179

🇺🇸 20.65.202.63

🇦🇷 200.189.31.96

🇲🇽 189.216.40.94