JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 209.38.80.3

209.38.80.3 was found in our database!

This IP was reported 58 times. Confidence of Abuse is 1%: ?

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Hostname(s)	catherinefieldpreschool.com.au
Domain Name	digitalocean.com
Country	🇦🇺 Australia
City	Sydney, New South Wales

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 209.38.80.3

Whois 209.38.80.3

IP Abuse Reports for 209.38.80.3:

This IP address has been reported a total of 58 times from 48 distinct sources. 209.38.80.3 was first reported on November 19th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ramazan	2026-08-18 18:50:52 (3 weeks ago)	Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /.git/ /.git/hooks/post-commit.sample /.git/hooks/post-rec ... show more Fail2Ban: nginx-4xx \| Failures: 10 \| Log: /.git/ /.git/hooks/post-commit.sample /.git/hooks/post-receive.sample /.git/info/refs /.git/logs/refs/heads/development show less	Web App Attack Hacking
🇳🇱 jjnxpct	2026-03-12 04:48:38 (5 months ago)	Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ... show more Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: / (Rule ID: 920340) - Content-Type header missing from request with non-zero Content-Length show less	Web App Attack
🇺🇸 gamabe	2026-03-11 11:20:10 (6 months ago)	Detected crowdsecurity/http-cve-probing attack pattern. Reported by CrowdSec IDS.	Port Scan
🇩🇪 Skyrider	2026-03-11 11:12:36 (6 months ago)	crowdsecurity/CVE-2017-9841	Hacking
🇺🇸 TPI-Abuse	2026-03-11 08:25:59 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 04:25:53.086929 2026] [security2:error] [pid 15664:tid 15664] [client 209.38.80.3:29256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "procurement.ic1.biz"] [uri "/.env"] [unique_id "abEnEY9tGdsk6XdJsK6gDwAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇿 Tripwire	2026-03-11 07:57:46 (6 months ago)	Scanning for exploits - /.env	Web App Attack
🇨🇭 TheCoon	2026-03-11 07:45:01 (6 months ago)	Automated: Credential theft attempt - JSON bomb served	Web App Attack Hacking
🇮🇩 Burayot	2026-03-11 07:32:51 (6 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 209.38.80.3 (AU/Australia/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 209.38.80.3 (AU/Australia/-): 1 in the last 3600 secs show less	Web App Attack
🇺🇦 URAN Publishing Service	2026-03-11 07:23:54 (6 months ago)	209.38.80.3 - - [11/Mar/2026:09:23:40 +0200] "GET /.env HTTP/1.1" 404 3090 "-" "Mozilla/5.0 (Windows ... show more 209.38.80.3 - - [11/Mar/2026:09:23:40 +0200] "GET /.env HTTP/1.1" 404 3090 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" 209.38.80.3 - - [11/Mar/2026:09:23:53 +0200] "GET /.env HTTP/1.1" 404 310 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-03-11 07:16:55 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 03:16:51.907959 2026] [security2:error] [pid 9484:tid 9484] [client 209.38.80.3:25560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "probiopharmaceutical.com"] [uri "/.env"] [unique_id "abEW48rBeCOV3-y-g6Q6qAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-11 06:54:30 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 02:54:25.065561 2026] [security2:error] [pid 16214:tid 16214] [client 209.38.80.3:31704] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "probeanalysis.com.afjm.net"] [uri "/.env"] [unique_id "abERoWMGbcm4M9h92xM65wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 helix	2026-03-11 06:25:20 (6 months ago)	Automated report: SSH brute force detected. This IP exceeded the allowed number of failed login atte ... show more Automated report: SSH brute force detected. This IP exceeded the allowed number of failed login attempts (3 attempts). show less	Brute-Force SSH
🇩🇪 LRob	2026-03-11 06:15:08 (6 months ago)	Repeated 404 errors, blocked by Fail2ban in custom-404 jail	Bad Web Bot
Anonymous	2026-03-11 06:05:32 (6 months ago)	Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=17	Hacking
🇺🇸 TPI-Abuse	2026-03-11 05:53:43 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 209.38.80.3 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 01:53:37.474375 2026] [security2:error] [pid 13087:tid 13087] [client 209.38.80.3:60492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pro.handyrehab.com"] [uri "/.env"] [unique_id "abEDYVuvSQjj4fCUnh53ewAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 58 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.126

🇧🇷 187.110.238.50

🇲🇾 47.250.120.139

🇳🇱 34.178.131.110

🇬🇧 193.163.125.172

🇩🇪 130.12.182.122

🇺🇸 35.89.130.69

🇫🇷 5.196.97.24

🇺🇸 2607:f8b0:4001:c0b::121

🇹🇳 197.5.145.102

🇨🇳 175.11.242.0

🇧🇷 168.227.224.197

🇵🇱 109.196.152.45

🇫🇷 91.231.89.7

🇫🇮 65.109.240.54

🇧🇪 34.78.187.32

🇺🇿 213.230.86.92

🇺🇸 205.210.31.99

🇨🇱 200.27.142.120

🇺🇸 185.226.198.4