JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 63.185.94.2

63.185.94.2 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-63-185-94-2.eu-central-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 63.185.94.2

Whois 63.185.94.2

IP Abuse Reports for 63.185.94.2:

This IP address has been reported a total of 48 times from 45 distinct sources. 63.185.94.2 was first reported on June 26th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇱 strefapi_com	2026-07-01 16:55:33 (3 hours ago)	Brute-force, web ...	Hacking Brute-Force Web App Attack
🇺🇸 interbiznw.com	2026-07-01 16:40:04 (3 hours ago)	malicious-web-requests-vulnerability-scanning	Hacking Brute-Force Exploited Host Web App Attack
🇩🇪 findlab	2026-07-01 16:35:01 (3 hours ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-01 16:20:04 (3 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇳🇱 Mangelot Hosting	2026-07-01 16:09:50 (4 hours ago)	(db_admin_scan) srv104 DB admin scan 63.185.94.2 (DE/Germany/ec2-63-185-94-2.eu-central-1.compute.am ... show more (db_admin_scan) srv104 DB admin scan 63.185.94.2 (DE/Germany/ec2-63-185-94-2.eu-central-1.compute.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 Charlesiv	2026-07-01 16:00:07 (4 hours ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) Protocol: HTTP/1.1 (GET method) Endpoint: /adminer.php Timestamp: 2026-07-01T15:55:59Z Ray ID: a146992058bf3720 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0 show less	Bad Web Bot
🇩🇪 Nevermind	2026-07-01 15:37:14 (4 hours ago)	63.185.94.2 - - [01/Jul/2026:17:37:13 +0200] "GET /adminer.php HTTP/1.1" 404 468 "-" "Mozilla/5.0 (W ... show more 63.185.94.2 - - [01/Jul/2026:17:37:13 +0200] "GET /adminer.php HTTP/1.1" 404 468 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 63.185.94.2 - - [01/Jul/2026:17:37:13 +0200] "GET /adminer.php HTTP/1.1" 404 468 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0" 63.185.94.2 - - [01/Jul/2026:17:37:13 +0200] "GET /adminer.php HTTP/1.1" 404 468 "http://divimap.de/adminer.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 63.185.94.2 - - [01/Jul/2026:17:37:13 +0200] "GET /adminer.php HTTP/1.1" 404 468 "http://divimap.de/adminer.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0" ... show less	Web App Attack
🇩🇪 conseilgouz	2026-07-01 15:15:44 (5 hours ago)	ave-21 : Rogue PHP files=>/adminer.php	Hacking
🇺🇸 mnsf	2026-07-01 15:05:39 (5 hours ago)	Too many Status 40X (15)	Brute-Force Web App Attack
🇩🇪 Viveronese	2026-07-01 14:15:40 (6 hours ago)	HTTP vulnerability scanning	Web App Attack
🇬🇷 setupgr	2026-07-01 14:08:08 (6 hours ago)	(mod_security) mod_security (id:1000001) triggered by 63.185.94.2 (DE/Germany/Hesse/Frankfurt am Mai ... show more (mod_security) mod_security (id:1000001) triggered by 63.185.94.2 (DE/Germany/Hesse/Frankfurt am Main/-/[AS16509 AMAZON-02]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Jul 01 17:08:05.362468 2026] [security2:error] [pid 2925083:tid 2925216] [client 63.185.94.2:56487] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/adminer.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "103"] [id "1000001"] [msg "Bad file blocked: /adminer.php"] [severity "CRITICAL"] [tag "security"] [hostname "asteriassantorini.com"] [uri "/adminer.php"] [unique_id "akUfRes0X0HnfxMaTmPnKAAABEo"] show less	Port Scan
🇪🇸 el-brujo	2026-07-01 13:55:48 (6 hours ago)	[Wed Jul 01 15:55:47.207651 2026] [proxy_fcgi:error] [pid 173377:tid 175979] [remote 63.185.94.2:0] ... show more [Wed Jul 01 15:55:47.207651 2026] [proxy_fcgi:error] [pid 173377:tid 175979] [remote 63.185.94.2:0] AH01071: Got error 'Primary script unknown\n' [Wed Jul 01 15:55:47.383892 2026] [proxy_fcgi:error] [pid 173387:tid 175476] [remote 63.185.94.2:0] AH01071: Got error 'Primary script unknown\n' ... show less	Hacking Web App Attack
🇫🇷 Cuteminded	2026-07-01 13:29:30 (6 hours ago)	Blocked for web application attacks	Web App Attack
🇺🇸 helios.live	2026-07-01 13:25:07 (6 hours ago)	2026/07/01 13:25:05 [error] 2699570#2699570: 456823 FastCGI sent in stderr: "Primary script unknown ... show more 2026/07/01 13:25:05 [error] 2699570#2699570: 456823 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 63.185.94.2, server: kocerroxy.com, request: "GET /adminer.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 63.185.94.2 - - [01/Jul/2026:13:25:05 +0000] "GET /adminer.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 2026/07/01 13:25:05 [error] 2699570#2699570: *456823 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 63.185.94.2, server: kocerroxy.com, request: "GET /adminer.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php8.4-fpm-betakocerroxycom.sock:", host: "kocerroxy.com" 63.185.94.2 - - [01/Jul/2026:13:25:05 +0000] "GET /adminer.php HTTP/1.1" 404 47 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/2010010 ... show less	Web App Attack
Anonymous	2026-07-01 13:21:20 (6 hours ago)	63.185.94.2 - - [01/Jul/2026:10:21:18 -0300] "GET /adminer.php HTTP/1.1" 404 826 "https://blogmania. ... show more 63.185.94.2 - - [01/Jul/2026:10:21:18 -0300] "GET /adminer.php HTTP/1.1" 404 826 "https://blogmania.com.br/adminer.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 63.185.94.2 - - [01/Jul/2026:10:21:18 -0300] "GET /adminer.php HTTP/1.1" 404 826 "https://blogmania.com.br/adminer.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0" ... show less	Port Scan

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 155.103.69.40

🇳🇱 204.76.203.10

🇳🇱 204.76.203.6

🇩🇪 167.94.146.41

🇺🇸 129.121.78.24

🇳🇱 91.92.40.5

🇳🇱 78.142.18.172

🇨🇱 68.211.177.55

🇩🇪 18.199.24.164

🇲🇰 188.44.20.33

🇩🇪 185.220.100.242

🇺🇸 103.168.66.246

🇫🇷 91.238.181.10

🇺🇸 91.230.168.120

🇺🇸 66.132.172.105

🇺🇸 20.115.51.161

🇺🇸 20.46.251.132

🇺🇸 20.46.235.137

🇦🇷 2800:190:5::43

🇪🇬 197.53.79.134