JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.25.129.120

3.25.129.120 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Corporate Services Pty Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-25-129-120.ap-southeast-2.compute.amazonaws.com
Domain Name	amazon.com.au
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.25.129.120

Whois 3.25.129.120

IP Abuse Reports for 3.25.129.120:

This IP address has been reported a total of 25 times from 23 distinct sources. 3.25.129.120 was first reported on October 26th 2026, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 andypiper	2026-10-27 02:02:13 (5 hours ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇩🇪 big-cloud.nl	2026-10-27 01:47:03 (5 hours ago)	Try to access /wp-includes/Requests/library/about.php	Web App Attack
🇫🇷 Baking333	2026-10-27 01:12:16 (6 hours ago)	[redacted] 3.25.129.120 - - [27/Oct/2026:02:12:14 +0100] "GET /wp-admin/[redacted] HTTP/1.1" 302 155 ... show more [redacted] 3.25.129.120 - - [27/Oct/2026:02:12:14 +0100] "GET /wp-admin/[redacted] HTTP/1.1" 302 1559 0/56259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 443 [redacted] 3.25.129.120 - - [27/Oct/2026:02:12:14 +0100] "GET / HTTP/1.1" 200 9110 0/84742 "https://[redacted]/wp-admin/[redacted]" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 443 show less	Bad Web Bot Web App Attack
🇺🇸 [email protected]	2026-10-27 00:22:26 (7 hours ago)	CrowdSec ban: crowdsecurity/http-crawl-non_statics (duration: 71h59m52s)	Web App Attack
Anonymous	2026-10-27 00:02:41 (7 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇩🇪 mondor.ro	2026-10-26 23:54:52 (7 hours ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 3.25.129.120, Reas ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, TEMPDENY 3.25.129.120, Reason:[3.25.129.120 (AU/Australia/ec2-3-25-129-120.ap-southeast-2.compute.amazonaws.com), more than 60 Apache 404 hits in the last 3600 secs]; Ports: 80,443; Direction: in; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇷🇴 clauss	2026-10-26 22:35:28 (8 hours ago)	3.25.129.120 - - [27/Oct/2026:00:35:26 +0200] "GET /xleet.php HTTP/2.0" 404 3412 "-" "Mozilla/5.0 (W ... show more 3.25.129.120 - - [27/Oct/2026:00:35:26 +0200] "GET /xleet.php HTTP/2.0" 404 3412 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 3.25.129.120 - - [27/Oct/2026:00:35:27 +0200] "GET /12.php HTTP/2.0" 404 3412 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇩🇪 zumbo.net	2026-10-26 22:11:58 (9 hours ago)	[Tue Oct 27 01:09:26.200972 2026] [proxy_fcgi:error] [pid 533999:tid 534034] [client 3.25.129.120:0] ... show more [Tue Oct 27 01:09:26.200972 2026] [proxy_fcgi:error] [pid 533999:tid 534034] [client 3.25.129.120:0] AH01071: Got error 'Primary script unknown' [Tue Oct 27 01:09:26.524214 2026] [proxy_fcgi:error] [pid 534000:tid 534053] [client 3.25.129.120:0] AH01071: Got error 'Primary script unknown' [Tue Oct 27 01:09:33.746792 2026] [proxy_fcgi:error] [pid 534000:tid 534050] [client 3.25.129.120:0] AH01071: Got error 'Primary script unknown' [Tue Oct 27 01:10:44.281175 2026] [proxy_fcgi:error] [pid 534000:tid 534021] [client 3.25.129.120:0] AH01071: Got error 'Primary script unknown' [Tue Oct 27 01:11:57.506902 2026] [proxy_fcgi:error] [pid 534000:tid 534055] [client 3.25.129.120:0] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
🇬🇧 Apache	2026-10-26 21:50:20 (9 hours ago)	(mod_security) mod_security (id:20000010) triggered by 3.25.129.120 (AU/Australia/ec2-3-25-129-120.a ... show more (mod_security) mod_security (id:20000010) triggered by 3.25.129.120 (AU/Australia/ec2-3-25-129-120.ap-southeast-2.compute.amazonaws.com): 5 in the last 300 secs show less	Brute-Force Web App Attack
Anonymous	2026-10-26 21:43:59 (9 hours ago)	IP matched detection query 20 more in short time bad rqs.	Brute-Force Web App Attack Hacking
🇪🇸 robotstxt	2026-10-26 21:31:23 (9 hours ago)	3.25.129.120 - - [26/Oct/2026:21:26:54 +0000] "GET /images/class-config.php HTTP/2.0" 403 20 "https: ... show more 3.25.129.120 - - [26/Oct/2026:21:26:54 +0000] "GET /images/class-config.php HTTP/2.0" 403 20 "https://fireflycomms.com/images/class-config.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="3.25.129.120" 3.25.129.120 - - [26/Oct/2026:21:27:59 +0000] "GET /wp-content/themes/twenty/twenty.php HTTP/2.0" 403 20 "https://fireflycomms.com/wp-content/themes/twenty/twenty.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="3.25.129.120" 3.25.129.120 - - [26/Oct/2026:21:30:09 +0000] "GET /wp-content/themes/sketch/404.php HTTP/2.0" 403 20 "https://fireflycomms.com/wp-content/themes/sketch/404.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="3.25.129.120" 3.25.129.120 - - [26/Oct/2026:21:30:50 +0000] "GET /wp-content/themes/tflow/up.php HTTP/2.0" 403 20 "https://fir ... show less	Web App Attack
🇳🇱 Alt255	2026-10-26 19:32:11 (11 hours ago)	[ti-05al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ... show more [ti-05al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 3.25.129.120 - - [26/Oct/2026:20:31:39 +0100] "GET /king.php HTTP/2.0" 404 35642 "https://www.code04.com/king.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 3.25.129.120 - - [26/Oct/2026:20:31:40 +0100] "GET /wp-admin/file.php HTTP/2.0" 404 35509 "https://www.code04.com/wp-admin/file.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 3.25.129.120 - - [26/Oct/2026:20:31:42 +0100] "GET /credits.php HTTP/2.0" 404 35509 "https://www.code04.com/credits.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 3.25.129.120 - - [26/Oct/2026 ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-26 18:05:14 (13 hours ago)	Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=15	Hacking
🇺🇸 TPI-Abuse	2026-10-26 17:41:08 (13 hours ago)	(mod_security) mod_security (id:210730) triggered by 3.25.129.120 (ec2-3-25-129-120.ap-southeast-2.c ... show more (mod_security) mod_security (id:210730) triggered by 3.25.129.120 (ec2-3-25-129-120.ap-southeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 13:41:02.739798 2026] [security2:error] [pid 20134:tid 20142] [client 3.25.129.120:52476] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|jakobjolstad.com\|F\|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jakobjolstad.com"] [uri "/wp/wp-admin/includes/class-wp-filesystem-base.php.bak"] [unique_id "at-QrqUQvFL1fdNL0pA4PAAAAIY"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-10-26 17:31:03 (13 hours ago)	1.208 requests with url.path /.well-known/acme-challenge/.php 837 requests with url.path /.well ... show more 1.208 requests with url.path /.well-known/acme-challenge/.php 837 requests with url.path /.well-known/pki-validation/.php 61 requests with url.path /wp-sigunq.php show less	Brute-Force Bad Web Bot

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 198.211.117.135

🇮🇩 180.243.90.149

🇹🇷 176.40.115.226

🇺🇸 162.216.150.122

🇦🇪 92.96.173.228

🇨🇦 85.217.149.62

🇺🇸 73.241.195.59

🇺🇸 66.132.224.88

🇩🇪 65.111.26.172

🇮🇱 20.217.80.108

🇳🇱 185.242.226.9

🇺🇸 184.186.73.84

🇮🇳 160.191.28.10

🇮🇳 143.244.137.66

🇰🇷 125.140.60.32

🇦🇱 79.106.123.30

🇺🇸 66.132.186.246

🇩🇪 45.3.54.246

🇺🇸 20.169.58.16

🇯🇵 8.216.16.52