JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.112.211.130

3.112.211.130 was found in our database!

This IP was reported 79 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-112-211-130.ap-northeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇯🇵 Japan
City	Tokyo, Tokyo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.112.211.130

Whois 3.112.211.130

IP Abuse Reports for 3.112.211.130:

This IP address has been reported a total of 79 times from 67 distinct sources. 3.112.211.130 was first reported on July 6th 2026, and the most recent report was 37 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-12 05:22:56 (37 seconds ago)	(mod_security) mod_security (id:210492) triggered by 3.112.211.130 (ec2-3-112-211-130.ap-northeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 3.112.211.130 (ec2-3-112-211-130.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 01:22:53.328093 2026] [security2:error] [pid 23436:tid 23436] [client 3.112.211.130:54140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidocchino.com"] [uri "/.env.backup"] [unique_id "alMkrfEgG-jasELYku_EcAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-12 05:15:40 (7 minutes ago)	<jail> banned by fail2ban	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-07-12 05:13:22 (10 minutes ago)	45 attacks on env grabbing URLs, PHP URLs: GET /.env.backup HTTP/1.1 GET /config/services.php HTTP/1 ... show more 45 attacks on env grabbing URLs, PHP URLs: GET /.env.backup HTTP/1.1 GET /config/services.php HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 04:51:59 (31 minutes ago)	(mod_security) mod_security (id:210492) triggered by 3.112.211.130 (ec2-3-112-211-130.ap-northeast-1 ... show more (mod_security) mod_security (id:210492) triggered by 3.112.211.130 (ec2-3-112-211-130.ap-northeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 00:51:52.674683 2026] [security2:error] [pid 3483311:tid 3483311] [client 3.112.211.130:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "levabet.xyz"] [uri "/.env.staging"] [unique_id "alMdaEYUItgjuvCyJPOdTwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇲🇽 octageeks.com	2026-07-12 04:27:59 (55 minutes ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇨🇦 1gz	2026-07-12 03:52:07 (1 hour ago)	Triggered Cloudflare WAF (firewallManaged) from JP. Action taken: BLOCK Protocol: HTTP/1.1 (GET meth ... show more Triggered Cloudflare WAF (firewallManaged) from JP. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /wp-config.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 FeG Deutschland	2026-07-12 02:51:02 (2 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
Anonymous	2026-07-12 02:38:05 (2 hours ago)		Web App Attack
🇫🇷 Sklurk	2026-07-12 02:02:33 (3 hours ago)	Web App Attack	Web App Attack
🇮🇩 sockominfo	2026-07-12 02:00:29 (3 hours ago)	Reported by TangerangKota-CSIRT. Status: MALICIOUS	Hacking Email Spam
🇩🇪 juutis	2026-07-12 01:35:22 (3 hours ago)	Multiple WAF abuses - IP blocked	Hacking Brute-Force Web App Attack
🇬🇧 andypiper	2026-07-12 01:02:53 (4 hours ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇹🇭 MWA SOC	2026-07-12 00:34:47 (4 hours ago)		Hacking
🇩🇪 macrob	2026-07-12 00:23:27 (5 hours ago)	2026/07/12 00:23:25 [error] 2882676#2882676: 368870941 access forbidden by rule, client: 3.112.211. ... show more 2026/07/12 00:23:25 [error] 2882676#2882676: 368870941 access forbidden by rule, client: 3.112.211.130, server: finami.mx, request: "GET /.env.backup HTTP/2.0", host: "finami.mx" 2026/07/12 00:23:25 [error] 2882680#2882680: 368870239 access forbidden by rule, client: 3.112.211.130, server: finami.mx, request: "GET /api/.env HTTP/2.0", host: "finami.mx" 2026/07/12 00:23:25 [error] 2882680#2882680: 368869372 access forbidden by rule, client: 3.112.211.130, server: finami.mx, request: "GET /.env.prod HTTP/2.0", host: "finami.mx" ... show less	Web App Attack
🇺🇸 kosada.com	2026-07-12 00:15:40 (5 hours ago)	Web vulnerability probing: /api/.env	Web App Attack

Showing 1 to 15 of 79 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇿 2a02:598:96:8a00::b00:e7

🇳🇱 89.21.67.184

🇧🇷 201.86.46.145

🇬🇧 185.216.145.179

🇹🇭 125.27.12.122

🇻🇳 103.199.16.90

🇷🇴 80.94.92.179

🇺🇸 66.132.172.117

🇺🇸 64.62.156.29

🇺🇸 54.90.153.106

🇨🇳 47.104.241.152

🇱🇹 46.29.234.126

🇩🇪 45.135.193.191

🇺🇸 162.216.150.108

🇺🇸 147.185.132.224

🇨🇳 123.160.221.156

🇮🇷 93.117.8.247

🇩🇪 69.5.169.171

🇩🇪 69.5.169.144

🇺🇸 65.49.1.138