JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 13.38.38.20

13.38.38.20 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 48%: ?

48%

ISP	Amazon Data Services France
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-13-38-38-20.eu-west-3.compute.amazonaws.com
Domain Name	amazon.com
Country	🇫🇷 France
City	Paris, Ile-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 13.38.38.20

Whois 13.38.38.20

IP Abuse Reports for 13.38.38.20:

This IP address has been reported a total of 8 times from 7 distinct sources. 13.38.38.20 was first reported on July 18th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-19 10:53:14 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.38.38.20 (ec2-13-38-38-20.eu-west-3.compute. ... show more (mod_security) mod_security (id:210492) triggered by 13.38.38.20 (ec2-13-38-38-20.eu-west-3.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 06:53:08.186742 2026] [security2:error] [pid 16499:tid 16499] [client 13.38.38.20:36968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mispar.consulting"] [uri "/.git/config"] [unique_id "alyslHMEiEedicXD9ryfUAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 nekopavel	2026-07-19 09:07:14 (6 hours ago)	13.38.38.20 - - [19/Jul/2026:11:07:12 +0200]"GET /.git/config HTTP/1.1" 404 50890"-" mishashto.com " ... show more 13.38.38.20 - - [19/Jul/2026:11:07:12 +0200]"GET /.git/config HTTP/1.1" 404 50890"-" mishashto.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.011" "0.001""Paris" "FR" 13.38.38.20 - - [19/Jul/2026:11:07:12 +0200]"GET /.env HTTP/1.1" 404 50885"-" mishashto.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.005" "0.000""Paris" "FR" 13.38.38.20 - - [19/Jul/2026:11:07:12 +0200]"GET /.env.local HTTP/1.1" 404 50890"-" mishashto.com "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""0.009" "0.001""Paris" "FR" ... show less	Hacking Bad Web Bot Web App Attack
🇺🇸 ruusvuu	2026-07-19 03:35:08 (12 hours ago)	Automated abuse report: 15 attack/probe requests from Amazon.com, Inc. / FR. Targeted paths: /.env~, ... show more Automated abuse report: 15 attack/probe requests from Amazon.com, Inc. / FR. Targeted paths: /.env~, /.env1, /.env2, /.env_copy, /.git/config. Sample log lines: [mircapture] 2026-07-18 20:35:08: 13.38.38.20 GET /.env.backup 404 - - 0.970 ms [mircapture] 2026-07-18 20:35:08: 13.38.38.20 GET /.env.save 404 - - 0.870 ms [mircapture] 2026-07-18 20:35:08: 13.38.38.20 GET /.env.old 404 - - 1.031 ms Detected by an automated web-server log monitor. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 02:39:45 (13 hours ago)	(mod_security) mod_security (id:210492) triggered by 13.38.38.20 (ec2-13-38-38-20.eu-west-3.compute. ... show more (mod_security) mod_security (id:210492) triggered by 13.38.38.20 (ec2-13-38-38-20.eu-west-3.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 22:39:41.096701 2026] [security2:error] [pid 10112:tid 10112] [client 13.38.38.20:45662] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mirandaracewalks.com"] [uri "/.git/config"] [unique_id "alw47cYj2sOlLav_Aflm9QAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-18 23:09:31 (16 hours ago)	[SunJul1901:09:24.3840352026][security2:error][pid3340047:tid3340099][client13.38.38.20:0]ModSecurit ... show more [SunJul1901:09:24.3840352026][security2:error][pid3340047:tid3340099][client13.38.38.20:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$$\(41\271$\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require$child_process$.execsync$echo\$\(\(41\271$\)\\|base64-w0\).tostring.trimthrowobject.assign$newerror\(next_redirect${digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"miotrentino.it\"][uri\"/\"][unique_id\"alwHpGzIox-trc1F0XvENgAAAFA\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 Origon	2026-07-18 22:38:45 (17 hours ago)	http-sensitive-files - IP: 13.38.38.20 - time="2026-07-19T00:38:45+02:00" level=info msg="(555f66b4 ... show more http-sensitive-files - IP: 13.38.38.20 - time="2026-07-19T00:38:45+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-sensitive-files by ip 13.38.38.20 (FR/16509) : 4h ban on Ip 13.38.38.20" module=db show less	Web App Attack
🇮🇹 VHosting	2026-07-18 22:35:03 (17 hours ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇩🇪 filstal.org	2026-07-18 21:38:35 (18 hours ago)	Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ... show more Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths. show less	Hacking Brute-Force Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 139.28.241.54

🇲🇦 105.72.2.61

🇧🇷 46.254.105.182

🇮🇩 36.64.131.68

🇺🇸 193.151.188.227

🇲🇽 189.203.137.59

🇺🇿 185.191.141.115

🇹🇭 118.193.56.184

🇨🇳 42.229.45.11

🇺🇸 136.107.223.250

🇨🇳 116.181.10.110

🇱🇹 77.90.185.21

🇱🇹 62.60.130.219

🇯🇵 38.207.136.155

🇮🇳 20.204.14.100

🇺🇸 20.163.33.220

🇺🇸 2001:550:9005:2000::1a

🇩🇪 195.182.16.23

🇷🇺 193.143.1.51

🇺🇸 136.66.234.37