JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 16.52.96.213

16.52.96.213 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 43%: ?

43%

ISP	Amazon Data Services Canada
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-16-52-96-213.ca-central-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇨🇦 Canada
City	Montreal, Quebec

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 16.52.96.213

Whois 16.52.96.213

IP Abuse Reports for 16.52.96.213:

This IP address has been reported a total of 10 times from 7 distinct sources. 16.52.96.213 was first reported on May 25th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 WeCloudit-Anti-Abuse	2026-08-22 11:44:35 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-08-22 10:46:38 (1 day ago)	(caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.am ... show more (caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:10:46:34 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:10:46:34 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:10:46:34 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:10:46:34 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:10:46:34 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇮🇹 VHosting	2026-08-22 10:05:04 (1 day ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
🇳🇱 debestelapp	2026-08-22 09:55:07 (1 day ago)		Web App Attack
🇮🇹 sssrit	2026-08-22 05:47:18 (1 day ago)	16.52.96.213 - - [22/Aug/2026:07:47:17 +0200] "GET /phpinfo.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 ( ... show more 16.52.96.213 - - [22/Aug/2026:07:47:17 +0200] "GET /phpinfo.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 16.52.96.213 - - [22/Aug/2026:07:47:17 +0200] "GET /info.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 16.52.96.213 - - [22/Aug/2026:07:47:17 +0200] "GET /php.php HTTP/1.1" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Brute-Force
Anonymous	2026-08-22 05:20:05 (1 day ago)	(caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.am ... show more (caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:05:20:00 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:05:20:00 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:05:20:00 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:05:20:00 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:05:20:00 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇺🇸 TPI-Abuse	2026-08-22 00:26:12 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 16.52.96.213 (ec2-16-52-96-213.ca-central-1.com ... show more (mod_security) mod_security (id:210492) triggered by 16.52.96.213 (ec2-16-52-96-213.ca-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 20:26:04.881855 2026] [security2:error] [pid 21554:tid 21554] [client 16.52.96.213:40246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.regal.tr"] [uri "/.git/config"] [unique_id "aojsnL4JCXS9T6mRDaDVkQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-22 00:14:57 (1 day ago)	(caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.am ... show more (caddyscan) Scanner path probe from 16.52.96.213 (CA/Canada/ec2-16-52-96-213.ca-central-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:00:14:54 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:00:14:54 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:00:14:54 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:00:14:54 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 16.52.96.213 - - [22/Aug/2026:00:14:54 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇳🇱 homeshowdomain.nl	2026-05-25 21:59:09 (2 months ago)	Auto-ban: >3000 req/min op 2026-05-25	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-05-25 03:04:11 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 16.52.96.213 (ec2-16-52-96-213.ca-central-1.com ... show more (mod_security) mod_security (id:210492) triggered by 16.52.96.213 (ec2-16-52-96-213.ca-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 23:04:07.521400 2026] [security2:error] [pid 3856:tid 3972] [client 16.52.96.213:54032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.streamwriters.com.hdtv55.com"] [uri "/.git/config"] [unique_id "ahO8J4Hqat-GxGb3rahdwgAAAUA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 2a00:1450:400a:1000::126

🇺🇸 209.207.248.50

🇺🇸 204.44.98.159

🇲🇽 201.110.75.43

🇦🇷 190.196.248.152

🇹🇷 176.235.182.131

🇺🇸 173.254.244.165

🇳🇱 91.92.40.171

🇺🇸 45.114.243.81

🇮🇳 40.80.84.77

🇦🇷 191.103.34.92

🇯🇴 176.29.228.134

🇨🇳 124.72.180.246

🇲🇿 98.97.151.210

🇦🇷 98.97.134.211

🇳🇱 95.97.20.138

🇺🇸 66.187.7.97

🇺🇸 66.132.172.47

🇭🇰 65.181.79.60

🇺🇸 20.65.193.189