JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 16.170.238.153

16.170.238.153 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 3%: ?

ISP	Amazon Data Services Sweden
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-16-170-238-153.eu-north-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇪 Sweden
City	Stockholm, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 16.170.238.153

Whois 16.170.238.153

IP Abuse Reports for 16.170.238.153:

This IP address has been reported a total of 34 times from 11 distinct sources. 16.170.238.153 was first reported on August 2nd 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 abdubhai	2026-06-23 10:24:38 (1 day ago)	16.170.238.153 - - [23/Jun/2026: ...	Brute-Force
🇧🇪 cmbplf	2026-03-17 04:29:24 (3 months ago)	382 requests with url.path *.env	Brute-Force Bad Web Bot
🇨🇭 TheCoon	2026-03-17 02:00:01 (3 months ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
Anonymous	2026-03-17 01:57:02 (3 months ago)	Bot / scanning and/or hacking attempts: GET /.env?nocache=835439 HTTP/1.1, GET /.env?nocache=997220 ... show more Bot / scanning and/or hacking attempts: GET /.env?nocache=835439 HTTP/1.1, GET /.env?nocache=997220 HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 big-cloud.nl	2026-03-17 01:55:00 (3 months ago)	Try to access /.env?nocache=671254	Web App Attack
🇷🇺 DZBOT	2026-03-17 01:48:34 (3 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-03-17 01:46:01 (3 months ago)	(mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.c ... show more (mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 21:45:57.153136 2026] [security2:error] [pid 10227:tid 10227] [client 16.170.238.153:24091] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vanmeter.me"] [uri "/.env"] [unique_id "abiyVdDjKznKBcuZ4D-7yQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-03-17 01:43:36 (3 months ago)	IM360 WAF: Laravel .env file access	Web App Attack
🇩🇪 phil2k	2026-03-03 16:31:54 (3 months ago)	Firewall: Within 2026-02-28 10:46:20 - 2026-02-28 10:46:21 CET(+0100) identified: unallowed access f ... show more Firewall: Within 2026-02-28 10:46:20 - 2026-02-28 10:46:21 CET(+0100) identified: unallowed access from 16.170.238.153 on port 3306(mysql) (1 trial) Fail2ban: Within 2026-02-28 10:46:20 - 2026-02-28 10:46:21 CET(+0100) banned: 4 times by fail2ban[firewall]; 4 times by fail2ban[recidive] show less	Port Scan Brute-Force
🇩🇪 phil2k	2026-02-28 09:46:23 (3 months ago)	fail2ban:firewall:2026-02-28T10:46:20.938607+01:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> ... show more fail2ban:firewall:2026-02-28T10:46:20.938607+01:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=16.170.238.153 DST=<ANONYMIZED_IP> LEN=52 TOS=0x00 PREC=0x00 TTL=55 ID=50982 DF PROTO=TCP SPT=33512 DPT=3306 WINDOW=64860 RES=0x00 SYN URGP=0 2026-02-28T10:46:21.541085+01:00 <SRV> firewall: filter IN=<ANONYMIZED_INTERFACE> OUT= MAC=<ANONYMIZED_MAC> SRC=16.170.238.153 DST=<ANONYMIZED_IP> LEN=52 TOS=0x00 PREC=0x00 TTL=55 ID=50983 DF PROTO=TCP SPT=33512 DPT=3306 WINDOW=64860 RES=0x00 SYN URGP=0 show less	DDoS Attack Port Scan Brute-Force
🇮🇩 Kencang.ID	2025-12-14 23:38:00 (6 months ago)	Failed Login Attempt 2025-12-14 23:38:00 \| 16.170.238.153 \| Desktop \| Google Chrome \| Stockholm, Sto ... show more Failed Login Attempt 2025-12-14 23:38:00 \| 16.170.238.153 \| Desktop \| Google Chrome \| Stockholm, Stockholm, Sweden \| Amazon.com \| Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51 show less	FTP Brute-Force Brute-Force
🇮🇩 Kencang.ID	2025-12-12 21:14:48 (6 months ago)	Failed Login Attempt 2025-12-12 21:14:48 \| 16.170.238.153 \| Desktop \| Microsoft Edge \| Stockholm, St ... show more Failed Login Attempt 2025-12-12 21:14:48 \| 16.170.238.153 \| Desktop \| Microsoft Edge \| Stockholm, Stockholm, Sweden \| Amazon.com \| Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763 show less	FTP Brute-Force Brute-Force
🇺🇸 TPI-Abuse	2025-11-12 08:43:47 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.c ... show more (mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 03:43:42.151204 2025] [security2:error] [pid 3291:tid 3291] [client 16.170.238.153:51194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.27"] [uri "/.env"] [unique_id "aRRIvuBg9atcDbrNlT0FtwAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-12 07:55:13 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.c ... show more (mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 02:55:09.993351 2025] [security2:error] [pid 7965:tid 7965] [client 16.170.238.153:50988] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.9"] [uri "/.env"] [unique_id "aRQ9XeP7ZSaK4ivIWoXbxwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-12 03:18:33 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.c ... show more (mod_security) mod_security (id:210492) triggered by 16.170.238.153 (ec2-16-170-238-153.eu-north-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 11 22:18:26.327966 2025] [security2:error] [pid 28534:tid 28534] [client 16.170.238.153:52726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.37"] [uri "/.env"] [unique_id "aRP8gmuw-gU2qyvYrkdHOwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 2409:8770:2f0:650::63

🇺🇸 195.184.76.247

🇲🇽 189.173.112.84

🇩🇪 69.5.169.94

🇨🇦 20.116.27.239

🇳🇱 178.128.250.218

🇮🇳 111.223.3.176

🇻🇳 42.112.192.128

🇨🇳 223.12.211.66

🇰🇷 219.248.65.30

🇺🇸 174.168.146.152

🇨🇳 118.196.86.210

🇮🇳 117.242.47.207

🇮🇩 103.132.236.30

🇨🇦 85.217.149.32

🇺🇦 37.221.143.180

🇺🇸 2607:f8b0:400e:c09::12c

🇨🇳 218.94.25.243

🇮🇩 180.252.172.30

🇺🇸 172.202.117.177