JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.139.106.9

3.139.106.9 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 60%: ?

60%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-139-106-9.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.139.106.9

Whois 3.139.106.9

IP Abuse Reports for 3.139.106.9:

This IP address has been reported a total of 13 times from 12 distinct sources. 3.139.106.9 was first reported on August 21st 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Spider	2026-08-23 08:23:11 (1 week ago)	Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enu ... show more Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enumeration detected: 5 distinct endpoints probed within 10 minutes, cycling through common CMS install-path guesses. Sample: GET /.env.local (404) GET /.env (404) POST / (404) GET /.git/config (404) GET / (200) show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-23 08:12:29 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 3.139.106.9 (ec2-3-139-106-9.us-east-2.compute. ... show more (mod_security) mod_security (id:210492) triggered by 3.139.106.9 (ec2-3-139-106-9.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 04:12:23.761793 2026] [security2:error] [pid 32284:tid 32284] [client 3.139.106.9:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atlascoombs.com"] [uri "/.git/config"] [unique_id "aoqrZxHmY7x-1qpNwJjE-gAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇦 URAN Publishing Service	2026-08-23 04:35:06 (1 week ago)	[23/Aug/2026:07:35:05 +0300] -- 3.139.106.9 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.git/c ... show more [23/Aug/2026:07:35:05 +0300] -- 3.139.106.9 Ban reason: Scanner [CMS_GENERIC] \| Request: GET /.git/config HTTP/1.1 show less	Bad Web Bot Web App Attack
Anonymous	2026-08-23 04:17:34 (1 week ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇫🇷 masterguru	2026-08-23 02:58:13 (1 week ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)	Hacking Web App Attack
🇫🇷 breubit	2026-08-23 02:16:39 (1 week ago)	3.139.106.9 - - [23/Aug/2026:04:16:39 +0200] "GET /.env HTTP/1.1" 403 550 "-" "Mozilla/5.0 (Windows ... show more 3.139.106.9 - - [23/Aug/2026:04:16:39 +0200] "GET /.env HTTP/1.1" 403 550 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇳🇱 homeshowdomain.nl	2026-08-22 22:03:14 (1 week ago)	Auto-ban: >3000 req/min op 2026-08-22	Web App Attack SSH Hacking
🇫🇷 Octopuce	2026-08-22 20:35:24 (1 week ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 18:18:53 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 3.139.106.9 (ec2-3-139-106-9.us-east-2.compute. ... show more (mod_security) mod_security (id:210492) triggered by 3.139.106.9 (ec2-3-139-106-9.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 14:18:48.241477 2026] [security2:error] [pid 22758:tid 22783] [client 3.139.106.9:34222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atechtransmission.com"] [uri "/.git/config"] [unique_id "aonoCOCUicNFigKX63aRegAAARc"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-08-22 01:48:56 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-08-21 10:41:18 (1 week ago)	(caddyscan) Scanner path probe from 3.139.106.9 (US/United States/ec2-3-139-106-9.us-east-2.compute. ... show more (caddyscan) Scanner path probe from 3.139.106.9 (US/United States/ec2-3-139-106-9.us-east-2.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 3.139.106.9 - - [21/Aug/2026:10:41:14 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 3.139.106.9 - - [21/Aug/2026:10:41:14 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 3.139.106.9 - - [21/Aug/2026:10:41:14 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 3.139.106.9 - - [21/Aug/2026:10:41:14 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 3.139.106.9 - - [21/Aug/2026:10:41:14 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇩🇪 4server	2026-08-21 08:38:59 (1 week ago)	[FriAug2110:38:56.6116922026][security2:error][pid838289:tid838373][client3.139.106.9:0]ModSecurity: ... show more [FriAug2110:38:56.6116922026][security2:error][pid838289:tid838373][client3.139.106.9:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$$\(41\271$\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require$child_process$.execsync$echo\$\(\(41\271$\)\\|base64-w0\).tostring.trimthrowobject.assign$newerror\(next_redirect${digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"alessandrolucchini.ch\"][uri\"/\"][unique_id\"aogOoDBYfofuTtJdTQkemQAAAdc\"] show less	Port Scan Brute-Force Web App Attack
🇮🇹 VHosting	2026-08-21 08:35:06 (1 week ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.151

🇺🇦 188.163.1.114

🇨🇳 175.9.220.17

🇺🇸 136.67.130.194

🇺🇸 136.67.126.133

🇺🇸 136.67.117.21

🇺🇸 136.67.113.64

🇺🇸 136.67.112.104

🇧🇩 114.130.85.36

🇬🇧 35.203.211.105

🇺🇸 2607:f8b0:4004:c27::129

🇬🇧 217.146.80.113

🇺🇸 216.25.89.85

🇧🇷 192.140.116.186

🇫🇷 185.177.72.30

🇺🇸 179.61.232.104

🇺🇸 179.61.137.164

🇧🇷 177.125.169.218

🇧🇷 177.70.6.199

🇺🇸 136.67.108.181