DigitalOcean Referral Badge
cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back

ASN REPORT — AS16509 · Amazon.com, Inc.

First sighted: April 30, 2023, 3 a.m. · Last sighted: Jan. 11, 2026, 1:59 a.m.

Risk
100 (high)
Total hits
6214639
Total errors
558816
Observed IPs
115060
Top country
N/A
Top city
N/A

Risk

Model: v1 Computed: 2026-01-18 11:55:27
Risk score
100
High
Risk gradient
Key drivers are enriched against the published annotator catalog when available; otherwise sensible defaults are used.
Key drivers
Automated client behavior
Traffic patterns strongly suggest automation rather than a human-operated browser.
bot
Hits 2925106
Points 1364188.44
Scan velocity
High request rate and broad endpoint coverage suggest scanning or automated enumeration.
scan_velocity
Hits 106360
Points 85932.00
Sensitive file probing
Requests target commonly sensitive files, configs, backups, or administrative resources.
sfp
Hits 7266
Points 47580.14
Path traversal attempts
Request paths/parameters resemble attempts to access files outside intended directories.
trav
Hits 5346
Points 44746.29
Credential brute forcing
Repeated authentication attempts consistent with password guessing or credential stuffing.
cred
Hits 6507
Points 15060.76
Request size anomaly
Requests are unusually large or shaped in a way that suggests abuse or automation.
request_size
Hits 9818
Points 4328.81
Firewall probing
Traffic behavior suggests probing of access controls and protected surfaces.
fwprobe
Hits 352
Points 4189.46
User-Agent anomaly
User-Agent signals look missing, inconsistent, or indicative of non-browser tooling.
ua
Hits 42783
Points 3373.83
Command injection attempts
Request content resembles attempts to execute OS commands via an application.
cmdi
Hits 32
Points 542.11
SQL injection attempts
Input patterns resemble attempts to manipulate SQL queries via application parameters.
sqli
Hits 13
Points 241.80

Traffic

Rollup

Daily activity (hits per day) and basic HTTP rollup counters for this ASN.

Loading activity…
Daily activity (hits per day). Total in window: —.
Traffic rollup
HTTP status classes, URL diversity, and totals.
2xx
3157492
3xx
2350182
4xx
554252
5xx
4564
Unique URLs
2023982
Total hits
6214639
First seen
April 30, 2023, 3 a.m.
Last seen
Jan. 11, 2026, 1:59 a.m.

Annotators (All-time)

Heatmap of annotator × severity. Darker cells mean more volume in that band. Tip: switch to Weighted points to see what drives impact (not just noise).

Severity →
Low High
Automated client behavior bot
Traffic patterns strongly suggest automation rather than a human-operated browser.
hits 2925106 pts 1364188.44
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
10 2807725 1 1333669.38 July 8, 2023, 12:26 p.m. Dec. 17, 2025, 7:44 p.m.
bot 2807725
8 117381 1 30519.06 July 5, 2023, 10:37 p.m. Jan. 10, 2026, 2:40 a.m.
bot 117381
Scan velocity scan_velocity
High request rate and broad endpoint coverage suggest scanning or automated enumeration.
hits 106360 pts 85932.00
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
10 54555 1 68762.07 Aug. 25, 2023, 6:23 a.m. Nov. 15, 2025, 9:58 p.m.
scan_velocity 54555
12 2212 1 3369.92 July 26, 2023, 12:34 a.m. Nov. 15, 2025, 9:58 p.m.
scan_velocity 2212
14 1386 1 2482.58 Aug. 13, 2023, 8:37 p.m. Nov. 15, 2025, 9:58 p.m.
scan_velocity 1386
16 929 1 1911.17 Oct. 22, 2023, 11:36 p.m. Nov. 15, 2025, 9:58 p.m.
scan_velocity 929
18 609 1 1423.98 Oct. 22, 2023, 11:36 p.m. July 30, 2025, 1:14 p.m.
scan_velocity 609
22 418 1 1273.93 April 30, 2023, 11:08 a.m. July 30, 2025, 1:14 p.m.
scan_velocity 418
34 219 1 1183.30 Oct. 18, 2023, 4:50 p.m. May 28, 2025, 6:55 p.m.
scan_velocity 219
20 410 1 1083.60 Oct. 22, 2023, 11:36 p.m. July 30, 2025, 1:14 p.m.
scan_velocity 410
24 320 1 1082.38 Oct. 18, 2023, 4:49 p.m. July 30, 2025, 1:14 p.m.
scan_velocity 320
36 163 1 918.54 Oct. 18, 2023, 4:51 p.m. Nov. 12, 2023, 8:46 a.m.
scan_velocity 163
26 193 1 683.98 Oct. 18, 2023, 4:49 p.m. June 27, 2025, 2:15 a.m.
scan_velocity 193
32 151 1 677.66 Oct. 18, 2023, 4:50 p.m. June 27, 2025, 2:16 a.m.
scan_velocity 151
28 152 1 590.18 Oct. 18, 2023, 4:50 p.m. June 27, 2025, 2:15 a.m.
scan_velocity 152
30 118 1 488.70 Oct. 18, 2023, 4:50 p.m. June 27, 2025, 2:15 a.m.
scan_velocity 118
0 44525 1 0.00 April 30, 2023, 11:08 a.m. Nov. 15, 2025, 9:58 p.m.
scan_velocity 44525
Sensitive file probing sfp
Requests target commonly sensitive files, configs, backups, or administrative resources.
hits 7266 pts 47580.14
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
40 4816 1 38990.34 April 30, 2023, 6:54 a.m. Nov. 15, 2025, 9:58 p.m.
sensitive_file 4816
24 858 1 3714.80 July 6, 2023, 2:56 a.m. Dec. 17, 2025, 12:01 p.m.
sensitive_file 858
16 1329 1 3274.66 July 7, 2023, 7:53 a.m. Nov. 15, 2025, 9:58 p.m.
sensitive_file 1329
36 158 1 1101.20 Aug. 2, 2023, 5:28 p.m. March 2, 2025, 1:08 p.m.
sensitive_file 158
22 62 1 234.06 Nov. 13, 2023, 4:02 a.m. March 2, 2025, 1:08 p.m.
sensitive_file 62
34 29 1 186.55 Nov. 8, 2023, 3:22 a.m. April 28, 2025, 11:57 a.m.
sensitive_file 29
30 14 1 78.54 Nov. 11, 2023, 6:16 a.m. Dec. 30, 2023, 7:01 p.m.
sensitive_file 14
Path traversal attempts trav
Request paths/parameters resemble attempts to access files outside intended directories.
hits 5346 pts 44746.29
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
34 5251 1 44097.90 Aug. 2, 2023, 5:28 p.m. July 13, 2025, 8:35 a.m.
trav 5251
30 45 1 328.85 Oct. 28, 2024, 12:19 p.m. April 28, 2025, 11:57 a.m.
trav 45
28 25 1 167.44 Nov. 10, 2024, 10:20 a.m. April 28, 2025, 11:57 a.m.
trav 25
26 25 1 152.10 Nov. 10, 2024, 10:20 a.m. April 28, 2025, 11:57 a.m.
trav 25
Credential brute forcing cred
Repeated authentication attempts consistent with password guessing or credential stuffing.
hits 6507 pts 15060.76
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
10 2446 1 9441.19 April 30, 2023, 11:08 a.m. Sept. 26, 2025, 11:48 p.m.
cred 2446
8 1687 1 5195.96 July 18, 2023, 7:42 p.m. May 11, 2025, 8:57 p.m.
cred 1687
12 68 1 339.24 July 24, 2023, 6:40 p.m. Sept. 16, 2025, 11:30 p.m.
cred 68
6 36 1 71.28 Sept. 13, 2023, 10:35 a.m. April 27, 2025, 9:58 a.m.
cred 36
14 2 1 13.09 Nov. 3, 2023, 7:19 p.m. Nov. 3, 2023, 8 p.m.
cred 2
0 2268 1 0.00 April 30, 2023, 11:08 a.m. Sept. 26, 2025, 11:48 p.m.
cred 2268
Request size anomaly request_size
Requests are unusually large or shaped in a way that suggests abuse or automation.
hits 9818 pts 4328.81
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
14 7086 1 4166.42 May 22, 2025, 8:18 p.m. Dec. 17, 2025, 7:43 p.m.
request_size 7086
12 347 1 162.40 July 5, 2023, 10:37 p.m. Nov. 6, 2025, 11:13 a.m.
request_size 347
0 2385 1 0.00 Dec. 24, 2024, 6:13 p.m. Jan. 9, 2026, 4:56 p.m.
request_size 2385
Firewall probing fwprobe
Traffic behavior suggests probing of access controls and protected surfaces.
hits 352 pts 4189.46
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
30 267 1 3316.14 July 13, 2023, 9:14 a.m. Dec. 9, 2024, 6:34 a.m.
fwprobe 267
28 34 1 385.56 Oct. 10, 2023, 2:16 p.m. Dec. 17, 2024, 5:46 p.m.
fwprobe 34
22 34 1 262.55 Oct. 10, 2023, 3:07 p.m. Nov. 17, 2023, 4:43 p.m.
fwprobe 34
32 17 1 225.22 Oct. 31, 2023, 7:22 a.m. Nov. 17, 2023, 4:51 p.m.
fwprobe 17
User-Agent anomaly ua
User-Agent signals look missing, inconsistent, or indicative of non-browser tooling.
hits 42783 pts 3373.83
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
6 37983 1 2734.78 May 1, 2023, 3:02 p.m. Dec. 31, 2025, 2:30 p.m.
ua 37983
10 1826 1 262.94 July 6, 2023, 1:08 a.m. Jan. 10, 2026, 12:36 a.m.
ua 1826
8 2347 1 245.25 July 27, 2023, 1:54 p.m. Oct. 15, 2025, 7:07 p.m.
ua 2347
14 376 1 84.22 Aug. 2, 2023, 5:28 p.m. Sept. 23, 2025, 4:23 p.m.
ua 376
12 251 1 46.64 July 26, 2023, 11:36 a.m. Sept. 14, 2025, 1:10 a.m.
ua 251
Command injection attempts cmdi
Request content resembles attempts to execute OS commands via an application.
hits 32 pts 542.11
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
28 13 1 272.27 Nov. 10, 2024, 10:22 a.m. April 28, 2025, 11:57 a.m.
cmdi 13
22 19 1 269.84 Nov. 10, 2024, 10:22 a.m. Aug. 13, 2025, 1:31 p.m.
cmdi 19
SQL injection attempts sqli
Input patterns resemble attempts to manipulate SQL queries via application parameters.
hits 13 pts 241.80
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
24 10 1 196.80 Jan. 3, 2025, 7:37 p.m. Jan. 3, 2025, 8:14 p.m.
sqli 10
20 3 1 45.00 Oct. 30, 2023, 9:12 p.m. Nov. 23, 2024, 9:46 a.m.
sqli 3
HTTP method anomaly method
Unusual or unexpected HTTP methods observed for the target endpoints.
hits 119 pts 58.50
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
10 80 1 44.16 Aug. 16, 2023, 10:48 a.m. Oct. 12, 2025, 7:46 a.m.
method 80
8 31 1 12.65 Nov. 6, 2023, 11:15 a.m. Oct. 15, 2025, 7:07 p.m.
method 31
5 6 1 1.44 Nov. 7, 2023, 1:22 p.m. Nov. 9, 2023, 8:28 p.m.
method 6
3 2 1 0.25 July 13, 2023, 12:16 p.m. July 21, 2023, 10:45 p.m.
method 2
Protocol anomaly proto
Request structure or protocol-level signals deviate from typical browser HTTP traffic.
hits 65 pts 40.76
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
11 45 1 27.72 Feb. 6, 2024, 4:53 p.m. Feb. 6, 2024, 4:54 p.m.
proto 45
12 16 1 11.06 Feb. 11, 2024, 11:16 a.m. Oct. 10, 2025, 12:48 p.m.
proto 16
22 1 1 1.58 July 21, 2023, 10:45 p.m. July 21, 2023, 10:45 p.m.
proto 1
3 3 1 0.40 July 21, 2023, 10:45 p.m. Jan. 24, 2025, 5:40 p.m.
proto 3
Referrer abuse ref
Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation.
hits 37 pts 4.66
Breakdown by severity band (all-time). “Weighted” reflects your weight configuration.
Severity Total Labels Weighted First seen Last seen Top labels
6 37 1 4.66 Dec. 22, 2023, 7 p.m. May 11, 2025, 8:57 p.m.
ref 37

HTTP Status Breakdown

Response mix grouped by status class (2xx/3xx/4xx/5xx). Auto-loads a single aggregation and renders a donut.

Loading status mix…
Running one aggregation and rendering the chart.

Geolocation

Live geolocation and map tiles auto-load for this ASN snapshot (peer IPs with coordinates).

Loading map…

SUBNETS HELD BY THIS ISP

Derived from ISP snapshot peers (Option A). Grouped into IPv4 /24 and IPv6 /48 by default.
IPv4
IPv6
Limit
Loading subnets…

Interesting IPs

Top risky peers inside this ASN (latest snapshot). Sorted by risk score, then hits.

No peer rows available for this ASN snapshot.