AbuseIPDB » 47.128.20.48

47.128.20.48 was found in our database!

This IP was reported 233 times. Confidence of Abuse is 28%: ?

28%

ISP	Amazon Data Services Singapore
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-47-128-20-48.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 47.128.20.48

Whois 47.128.20.48

IP Abuse Reports for 47.128.20.48:

This IP address has been reported a total of 233 times from 32 distinct sources. 47.128.20.48 was first reported on August 7th 2023, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2025-05-03 15:12:00 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.c ... show more(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 03 11:11:55.121326 2025] [security2:error] [pid 3698923:tid 3698923] [client 47.128.20.48:23450] [client 47.128.20.48] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.med-engineering.com|F|2"] [data ".jslw.med-engineering.com.nyh.cs"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.med-engineering.com"] [uri "/xii.jslw.med-engineering.com.nyh.cs"] [unique_id "aBYyO26XR6-q6im4YIP3bgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
librebit	2025-04-22 19:36:06 (3 weeks ago)	Brute force	Brute-Force
TPI-Abuse	2025-04-17 18:00:27 (4 weeks ago)	(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.c ... show more(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 17 14:00:22.639545 2025] [security2:error] [pid 30583:tid 30596] [client 47.128.20.48:64380] [client 47.128.20.48] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||digital4z.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "digital4z.com"] [uri "/wp-content/plugins/jetpack/languages/WS_FTP.LOG"] [unique_id "aAFBton4eGMOxoqXWf98KAAAAMo"] show less	Brute-Force Bad Web Bot Web App Attack
hermawan	2025-04-17 14:17:24 (4 weeks ago)	[Thu Apr 17 21:16:23.147971 2025] [security2:error] [pid 287816:tid 139689510160064] [client 47.128. ... show more[Thu Apr 17 21:16:23.147971 2025] [security2:error] [pid 287816:tid 139689510160064] [client 47.128.20.48:48610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Feed" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.10.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "204"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Feed found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email protected]) request_line = GET /index.php/profil/arsip-artikel?catid=483&id=997%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-24-30-mei-2016&start=100 HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aAENNywk5qc2GD6X5t87IgAAUwI"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[287819] [4wfYC8IXFBg] [aAENNywk5q ... show less	Hacking Web App Attack
Anonymous	2025-04-06 08:34:47 (1 month ago)	Ports: 80,443; Direction: 1; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2025-03-25 03:15:20 (1 month ago)	Ports: 80,443; Direction: 1; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Séfora Srl	2025-03-22 21:00:17 (1 month ago)	Bad user agents ignoring web crawling rules. Draing bandwidth - detected by Fail2Ban in plesk-apache ... show moreBad user agents ignoring web crawling rules. Draing bandwidth - detected by Fail2Ban in plesk-apache-badbot jail show less	Bad Web Bot
MAGIC	2025-03-20 16:27:46 (1 month ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
Mendip_Defender	2025-03-18 09:15:10 (1 month ago)	47.128.20.48 - - [18/Mar/2025:09:15:07 +0000] "GET /?pp=25&searchid=1828098 HTTP/1.0" 200 12379 "-" ... show more47.128.20.48 - - [18/Mar/2025:09:15:07 +0000] "GET /?pp=25&searchid=1828098 HTTP/1.0" 200 12379 "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email protected])" ... show less	Bad Web Bot
Anonymous	2025-03-16 23:01:02 (1 month ago)	Excessive crawling/scraping	Hacking Brute-Force
MAGIC	2025-03-01 12:01:43 (2 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
backslash	2025-02-25 15:10:14 (2 months ago)	block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638	Bad Web Bot
TPI-Abuse	2025-02-21 13:29:32 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.c ... show more(mod_security) mod_security (id:210730) triggered by 47.128.20.48 (ec2-47-128-20-48.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 21 08:29:24.434042 2025] [security2:error] [pid 1037606:tid 1037606] [client 47.128.20.48:10588] [client 47.128.20.48] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||med-engineering.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "med-engineering.com"] [uri "/mysoline.com"] [unique_id "Z7h_tC7X-jO8z3eUNyn3HwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
MAGIC	2025-02-20 07:12:11 (2 months ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
hermawan	2025-02-20 03:20:25 (2 months ago)	[Thu Feb 20 10:19:33.200167 2025] [security2:error] [pid 67075:tid 140257050023616] [client 47.128.2 ... show more[Thu Feb 20 10:19:33.200167 2025] [security2:error] [pid 67075:tid 140257050023616] [client 47.128.20.48:25590] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Feed" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.10.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "167"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Feed found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email protected]) request_line = GET /index.php/profil/meteorologi/list-of-all-tags/anomali HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-malang.info"] [uri "/index.php/profil/meteorologi/list-of-all-tags/anomali"] [unique_id "Z7afRVBHHREN0K0k07BeZwAA1Es"] [staklim-malang.info] [staklim-malang.info] top=[67151] [FKTCVwLnedM] [Z7afRVBHHREN0K0k07BeZwAA1Es] keep_alive=[1] [2025-02-20 10:19:33.200170] [R:Z7afRVBHHREN0K0k07BeZw ... show less	Hacking Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩