JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 47.128.59.104

47.128.59.104 was found in our database!

This IP was reported 276 times. Confidence of Abuse is 21%: ?

21%

ISP	Amazon Data Services Singapore
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 47.128.59.104

Whois 47.128.59.104

IP Abuse Reports for 47.128.59.104:

This IP address has been reported a total of 276 times from 42 distinct sources. 47.128.59.104 was first reported on September 16th 2023, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-25 12:17:47 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1 ... show more (mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 08:17:41.482938 2026] [security2:error] [pid 31584:tid 31584] [client 47.128.59.104:29854] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|informativearticles.com\|F\|2"] [data ".tripod.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "informativearticles.com"] [uri "/poetry/at http:/dennissiluk.tripod.com"] [unique_id "amSpZYR5O-ppiZIZXLI2lgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 YF	2026-07-17 08:31:04 (1 week ago)	WordPress content enumeration	Web App Attack
🇪🇸 masterguru	2026-07-16 09:39:51 (1 week ago)	BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000 ... show more BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000-122) show less	Bad Web Bot
🇪🇸 masterguru	2026-07-12 01:06:36 (2 weeks ago)	BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000 ... show more BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000-122) show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-06-15 17:20:40 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1 ... show more (mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 13:20:33.447449 2026] [security2:error] [pid 17894:tid 17894] [client 47.128.59.104:44800] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.informativearticles.com\|F\|2"] [data ".brain-floss.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.informativearticles.com"] [uri "/writing-articles/http/www.brain-floss.com"] [unique_id "ajA0YU3aLyVg3nPRiSWOjgAAACs"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 masterguru	2026-05-13 20:42:43 (2 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000 ... show more BAD BOT - Detected and Blocked.. Matched phrase "bytespider" at REQUEST_HEADERS:user-agent. (1100000-122) show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-04-12 15:25:26 (3 months ago)	(mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1 ... show more (mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 11:25:19.557427 2026] [security2:error] [pid 1205499:tid 1205499] [client 47.128.59.104:51774] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.informativearticles.com\|F\|2"] [data ".adam-eason.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.informativearticles.com"] [uri "/innovation/ww.adam-eason.com"] [unique_id "adu5Xwc7CfBn-f07yBVgAwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-05 12:48:05 (3 months ago)	Ports: 80,443; Direction: 1; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇱🇺 conseilgouz	2026-03-23 20:54:06 (4 months ago)	are-88 : Bloc AI bots=>/de/component/icagenda/8-fete-nationale-3?iccaldate=2030-5-1(Bytespider)	Hacking
🇺🇸 TPI-Abuse	2026-03-16 10:16:07 (4 months ago)	(mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1 ... show more (mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 16 06:16:02.748147 2026] [security2:error] [pid 31418:tid 31418] [client 47.128.59.104:18300] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|informativearticles.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "informativearticles.com"] [uri "/site-promotion/donutshopcop.com"] [unique_id "abfYYi7xep-i9LrMix8hUAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 bigorre.org	2026-02-19 10:09:41 (5 months ago)	Excessive crawling : exceed crawl-delay defined in robots.txt	Bad Web Bot
🇺🇸 TPI-Abuse	2026-02-12 19:31:50 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1 ... show more (mod_security) mod_security (id:210730) triggered by 47.128.59.104 (ec2-47-128-59-104.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 14:31:44.539511 2026] [security2:error] [pid 21106:tid 21106] [client 47.128.59.104:64856] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.lertap5.com\|F\|2"] [data ".spss.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lertap5.com"] [uri "/HTMLHelp/Lrtp59HTML/www.spss.com"] [unique_id "aY4qoI_gbi_GIltA-WLC5QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2026-02-10 09:35:06 (5 months ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇨🇦 1gz	2026-01-25 01:19:33 (6 months ago)	Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: BLOCK Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email protected]) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇮🇳 dineshskt4all	2026-01-13 19:08:08 (6 months ago)	47.128.59.104 - - [13/Jan/2026:19:08:06 +0000] "GET /robots.txt HTTP/1.1" 200 160 "-" "Mozilla/5.0 ( ... show more 47.128.59.104 - - [13/Jan/2026:19:08:06 +0000] "GET /robots.txt HTTP/1.1" 200 160 "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; [email protected])" ... show less	IoT Targeted

Showing 1 to 15 of 276 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 91.231.89.8

🇺🇸 66.132.186.226

🇫🇮 2a01:4f9:4b:1513::2

🇰🇷 222.107.156.227

🇰🇷 211.253.31.30

🇳🇱 192.42.116.18

🇸🇪 185.246.130.20

🇲🇾 180.74.142.250

🇧🇷 177.91.72.2

🇻🇳 113.167.37.224

🇨🇳 106.12.127.250

🇺🇸 103.144.245.123

🇺🇸 99.6.104.157

🇺🇸 66.132.186.220

🇺🇸 23.94.28.177

🇷🇺 178.213.114.194

🇭🇰 165.154.6.224

🇺🇸 162.216.150.159

🇺🇸 147.185.132.120

🇨🇳 116.53.130.4