AbuseIPDB » 3.109.59.242

3.109.59.242 was found in our database!

This IP was reported 37 times. Confidence of Abuse is 52%: ?

52%

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	ec2-3-109-59-242.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 3.109.59.242

Whois 3.109.59.242

IP Abuse Reports for 3.109.59.242:

This IP address has been reported a total of 37 times from 29 distinct sources. 3.109.59.242 was first reported on August 13th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
polycoda	2024-08-14 12:20:00 (1 month ago)	Requests tons of inexistent files	Hacking Web App Attack
cmbplf	2024-08-14 11:02:44 (1 month ago)	145.150 geo requests in 3 hours (1w3d17h)	Brute-Force Bad Web Bot
RLDD	2024-08-14 09:23:38 (1 month ago)	WP probing for vulnerabilities -mai	Web App Attack
RLDD	2024-08-14 08:51:05 (1 month ago)	WP probing for vulnerabilities -mob	Web App Attack
Evag Touf	2024-08-14 08:36:50 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted] 3.109.59.242 (IN/India/-): (CF_ENABLE)	SQL Injection
Anonymous	2024-08-14 08:15:14 (1 month ago)	fail2ban apache-modsecurity [msg "Restricted access based on geolocation rules."] [uri "/templates/e ... show morefail2ban apache-modsecurity [msg "Restricted access based on geolocation rules."] [uri "/templates/enproma/js/jquery.min.js"] show less	Web App Attack
RLDD	2024-08-14 07:17:47 (1 month ago)	WP probing for vulnerabilities -lev	Web App Attack
Roderic	2024-08-14 07:16:36 (1 month ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 3.109.59.242 (IN/Ind ... show more(apache-useragents) Failed apache-useragents trigger with match [redacted] from 3.109.59.242 (IN/India/ec2-3-109-59-242.ap-south-1.compute.amazonaws.com) show less	Bad Web Bot
kumiko	2024-08-14 07:10:18 (1 month ago)	[2024-08-14 07:10:17] Probing for exploits [1 requests] "GET //<Domain name omitted>/js/cook ... show more[2024-08-14 07:10:17] Probing for exploits [1 requests] "GET //<Domain name omitted>/js/cookies.js HTTP/1.1" 404 show less	Brute-Force Bad Web Bot Web App Attack
4server	2024-08-13 20:11:15 (1 month ago)	[TueAug1322:10:16.0400972024][security2:error][pid5308:tid5445][client3.109.59.242:0][client3.109.59 ... show more[TueAug1322:10:16.0400972024][security2:error][pid5308:tid5445][client3.109.59.242:0][client3.109.59.242]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"\^$\?:web\(\?:\(\?:st\(\?:ripp$\?\\|download\\|copi\)er\\|zip\)\\|$\?:prowebwalk\\|sitesnagg$er\\|c$\?:heesebot\\|ombine$\\|teleportpro\\|blackhole\\|chinaclaw\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"158\"][id\"330019\"][rev\"3\"][msg\"Atomicorp.comWAFRules:SuspiciousWebClientDetected$Disablethisruleifyouwishtoallowtheseclients$\"][severity\"ERROR\"][hostname\"foodelivery.benvenutialfood.ch\"][uri\"/foodelivery.benvenutialfood.ch/wp-content/plugins/woofood-plugin/js/ajax_add_to_cart.js\"][unique_id\"Zru9qAxx1VOIWiUO2wg2qgAAAQI\"][TueAug1322:10:19.8078072024][security2:error][pid5197:tid5264][client3.109.59.242:0][client3.109.59.242]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx$MSWebServicesClientProtocol\\|WormlyBot\\|webauth@cmcm\\\\\\\\.com$\"against\"REQUEST_HEADERS:User- show less	Blog Spam
TPI-Abuse	2024-08-13 19:36:56 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 3.109.59.242 (ec2-3-109-59-242.ap-south-1.compu ... show more(mod_security) mod_security (id:210831) triggered by 3.109.59.242 (ec2-3-109-59-242.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 13 15:36:48.881364 2024] [security2:error] [pid 29554:tid 29554] [client 3.109.59.242:36512] [client 3.109.59.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|donalep.com\|F\|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "donalep.com"] [uri "/"] [unique_id "Zru10BMLWXgzQI9F0KxLgQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-08-13 19:05:08 (1 month ago)	Unsollicted Connect (5 Times), to port(s): 80,443	Port Scan Bad Web Bot Web App Attack
Anonymous	2024-08-13 18:50:07 (1 month ago)	Unsollicted Connect (36 Times), to port(s): 80,443	Port Scan Bad Web Bot Web App Attack
Anonymous	2024-08-13 18:39:12 (1 month ago)	Bot / seems abusive / Apache connections: 135	DDoS Attack Web Spam Bad Web Bot Web App Attack
CollideTech	2024-08-13 18:36:08 (1 month ago)	probing for vulnerabilities	Web App Attack