JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 63.182.239.48

63.182.239.48 was found in our database!

This IP was reported 35 times. Confidence of Abuse is 100%: ?

100%

ISP	A100 ROW GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-63-182-239-48.eu-central-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 63.182.239.48

Whois 63.182.239.48

IP Abuse Reports for 63.182.239.48:

This IP address has been reported a total of 35 times from 22 distinct sources. 63.182.239.48 was first reported on June 25th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 BlueWire Hosting	2026-06-30 18:16:12 (3 days ago)	Probing websites for vulnerabilities	Web App Attack SQL Injection
🇺🇸 TPI-Abuse	2026-06-30 16:46:58 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 12:46:51.864648 2026] [security2:error] [pid 25244:tid 25244] [client 63.182.239.48:21830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "willmarksynthetics.com"] [uri "/.env.development"] [unique_id "akPy-2adlwMTF76Qd4kTDgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 alferez	2026-06-30 16:36:23 (3 days ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 16:12:59 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 12:12:53.629462 2026] [security2:error] [pid 18810:tid 18810] [client 63.182.239.48:18338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pnp42.com.grancanariaholidays.com"] [uri "/.env.template"] [unique_id "akPrBVLDuFcmupR8r6py3AAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 ConsulHosting	2026-06-30 15:23:40 (3 days ago)	Excessive failed CAPTCHA attempts (CAPTCHA DoS)	Web App Attack
🇳🇱 e.fierstra	2026-06-30 15:15:49 (3 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇳🇱 tpjg	2026-06-30 15:15:42 (3 days ago)	Automated: 15 requests with error status in 120s window from 63.182.239.48. Evidence: /.env.swp:404, ... show more Automated: 15 requests with error status in 120s window from 63.182.239.48. Evidence: /.env.swp:404,/.env.tmp:404,/.env.bak:404,/.env.old:404,/.env.save:404,/.env.backup:404,/.env.staging:404,/.env.test:404,/.env.prod:404,/.env.dev:404,/.env.development:404,/.env.production:404,/.env.local:404,/.env:404,/config:404 show less	Web App Attack
🇫🇮 as211431.net	2026-06-30 15:02:59 (3 days ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /.env.test UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Version Net	2026-06-30 14:17:07 (3 days ago)	IPS Detection: Spring.Boot.Actuator.Unauthorized.Access	Hacking
🇺🇸 TPI-Abuse	2026-06-30 12:38:55 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 08:38:51.436288 2026] [security2:error] [pid 11612:tid 11612] [client 63.182.239.48:63782] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ctrl-p.saltcityprint.com"] [uri "/.env.prod"] [unique_id "akO420J7-kXzlHj1DVY92gAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-06-30 11:54:44 (3 days ago)	[TueJun3013:54:40.0308632026][security2:error][pid144799:tid144917][client63.182.239.48:0]ModSecurit ... show more [TueJun3013:54:40.0308632026][security2:error][pid144799:tid144917][client63.182.239.48:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"essesolution.ch\"][uri\"/.env.local\"][unique_id\"akOugE93GguNj0U2AouTdgAAAQc\"] show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 10:56:06 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 06:56:01.499264 2026] [security2:error] [pid 17007:tid 17007] [client 63.182.239.48:26594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.berklie.com"] [uri "/public/.env"] [unique_id "akOgwZfdmUFyCnLOHL5fsgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 10:04:58 (4 days ago)	Aggressive web scan	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 09:51:03 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 63.182.239.48 (ec2-63-182-239-48.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 05:50:58.738831 2026] [security2:error] [pid 17029:tid 17029] [client 63.182.239.48:31264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.grandriverhomes.com"] [uri "/.env"] [unique_id "akORgsrlhs7VR6xGYg-VfQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Ba-Yu	2026-06-30 09:11:18 (4 days ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack

Showing 1 to 15 of 35 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 206.189.18.100

🇮🇳 203.163.245.232

🇧🇴 200.105.172.184

🇺🇸 195.184.76.97

🇸🇪 185.217.0.181

🇮🇳 182.19.35.57

🇩🇪 167.94.146.50

🇫🇷 161.97.130.213

🇺🇸 66.132.186.251

🇺🇸 66.132.186.241

🇺🇸 64.235.34.43

🇺🇸 17.22.253.113

🇨🇴 186.115.50.185

🇧🇷 177.61.176.110

🇺🇸 162.216.149.166

🇦🇺 120.157.53.98

🇮🇳 103.30.82.134

🇧🇷 45.229.91.34

🇧🇪 34.156.235.137

🇳🇵 27.34.64.39