JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 65.1.69.7

65.1.69.7 was found in our database!

This IP was reported 47 times. Confidence of Abuse is 90%: ?

90%

ISP	Amazon Data Services India
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-65-1-69-7.ap-south-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇳 India
City	Mumbai, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 65.1.69.7

Whois 65.1.69.7

IP Abuse Reports for 65.1.69.7:

This IP address has been reported a total of 47 times from 31 distinct sources. 65.1.69.7 was first reported on July 20th 2026, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-09-24 05:32:01 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.ama ... show more (mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 01:31:56.189961 2026] [security2:error] [pid 16987:tid 16987] [client 65.1.69.7:38676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "corstratinc.com"] [uri "/wp-config.php_"] [unique_id "arS1zAT7RWh4Wjjr7T1ByQAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-22 23:33:27 (1 day ago)	(mod_security) mod_security triggered on hostname [redacted] 65.1.69.7 (IN/India/ec2-65-1-69-7.ap-so ... show more (mod_security) mod_security triggered on hostname [redacted] 65.1.69.7 (IN/India/ec2-65-1-69-7.ap-south-1.compute.amazonaws.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-09-22 19:23:10 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.ama ... show more (mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 15:23:06.169088 2026] [security2:error] [pid 1211699:tid 1211699] [client 65.1.69.7:47906] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cottrillcyclodyne.com"] [uri "/wp-config.php_"] [unique_id "arLVmqVAxja910ft9OYHIwAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 Countryman	2026-09-22 04:22:07 (2 days ago)	repeated unauthorized connection attempts, host sweep, port scan	Port Scan
🇨🇿 Countryman	2026-09-22 04:22:07 (2 days ago)	repeated unauthorized connection attempts, host sweep, port scan	Port Scan
🇫🇷 dynamix	2026-09-20 08:12:18 (4 days ago)	Multiple WAF Violations	Web App Attack
🇩🇪 ghostwarriors	2026-09-20 07:50:06 (4 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-09-20 07:38:47 (4 days ago)	65.1.69.7 - - [20/Sep/2026:09:38:46 +0200] "GET /wp-config.php~ HTTP/1.1" 301 594 "-" "Mozilla/5.0 ( ... show more 65.1.69.7 - - [20/Sep/2026:09:38:46 +0200] "GET /wp-config.php~ HTTP/1.1" 301 594 "-" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.94 AOL/9.7 AOLBuild/4343.4049.US Safari/537.36" 65.1.69.7 - - [20/Sep/2026:09:38:43 +0200] "GET /_wpeprivate/config.json HTTP/1.1" 301 612 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" 65.1.69.7 - - [20/Sep/2026:09:38:44 +0200] "GET /_wpeprivate/config.json HTTP/1.1" 404 4602 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" 65.1.69.7 - - [20/Sep/2026:09:38:44 +0200] "GET /wp-config.php_ HTTP/1.1" 301 594 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0.2 Waterfox/40.0.2" 65.1.69.7 - - [20/Sep/2026:09:38:45 +0200] "GET /wp-config.php_ HTTP/1.1" 404 4601 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0.2 Waterfox/40.0.2" 65.1.69.7 - - [20/Sep/2026:09:38:45 +0200] "GET /wp-config.php HTTP/1. show less	Web App Attack Brute-Force
🇺🇸 TPI-Abuse	2026-09-20 04:37:58 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.ama ... show more (mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 00:37:52.733710 2026] [security2:error] [pid 19449:tid 19449] [client 65.1.69.7:55614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coroneta.com"] [uri "/wp-config.php_"] [unique_id "aq9jIASvI_xwYfvoIStvPAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 burlacu.org	2026-09-17 15:36:04 (6 days ago)	Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 47 attempt ... show more Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 47 attempts. Blocked automatically. show less	Web App Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-17 12:02:54 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.ama ... show more (mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 08:02:47.485896 2026] [security2:error] [pid 8019:tid 8019] [client 65.1.69.7:49022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crazypencil.com"] [uri "/wp-config.php_"] [unique_id "aqvW5wCEfvLVM9BybI10YAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-09-17 08:26:13 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.ama ... show more (mod_security) mod_security (id:210492) triggered by 65.1.69.7 (ec2-65-1-69-7.ap-south-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 17 04:26:08.942729 2026] [security2:error] [pid 19684:tid 19684] [client 65.1.69.7:56122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpking.com"] [uri "/wp-config.php_"] [unique_id "aqukIE51W5B1FSwKk9YnuAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-17 05:50:01 (1 week ago)	Aggressive web scan	Web App Attack
Anonymous	2026-09-17 05:09:34 (1 week ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: IN, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: IN, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇵🇱 mscode.pl	2026-09-17 01:50:56 (1 week ago)	Triggered Cloudflare WAF (firewallCustom) from IN. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) ... show more Triggered Cloudflare WAF (firewallCustom) from IN. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) Protocol: HTTP/1.1 (GET method) Zone: cp.mscode.pl Endpoint: /ftp-settings.json UA: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; yie9; rv:11.0) like Gecko show less	Bad Web Bot

Showing 1 to 15 of 47 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.59.114.157

🇿🇦 160.119.250.55

🇰🇪 102.216.68.192

🇳🇱 45.148.10.141

🇺🇦 31.134.118.83

🇺🇸 20.29.18.131

🇦🇩 135.136.16.28

🇰🇷 119.203.251.187

🇲🇦 105.158.218.228

🇻🇳 103.149.86.208

🇨🇦 85.217.149.31

🇮🇹 79.3.96.178

🇺🇸 64.227.0.10

🇺🇸 2602:f71d:400::20

🇩🇪 217.8.118.10

🇺🇸 216.24.219.238

🇫🇷 212.47.71.13

🇱🇹 185.169.4.164

🇭🇰 152.32.186.237

🇻🇳 123.22.173.36