JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.228.14.80

3.228.14.80 was found in our database!

This IP was reported 101 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-228-14-80.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.228.14.80

Whois 3.228.14.80

IP Abuse Reports for 3.228.14.80:

This IP address has been reported a total of 101 times from 79 distinct sources. 3.228.14.80 was first reported on September 15th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇸🇪 SkyDancer	2026-09-16 20:26:56 (3 hours ago)	Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by ... show more Multiple login attempts via RDP and/or SSH using wrong credentials. Attack automatically blocked by SkyDancer Ai via interface. show less	Hacking Brute-Force SSH
🇳🇱 Cyber SOC	2026-09-16 14:50:03 (9 hours ago)	Peaksys - 2026-09-16 15:46:24 UTC+01	Port Scan Hacking SQL Injection Web App Attack
🇪🇸 librebit	2026-09-16 06:27:42 (17 hours ago)	Bad guys doing bad things, bad crawling	Bad Web Bot
🇬🇧 openstrike.co.uk	2026-09-16 05:14:05 (19 hours ago)	69 attacks on password/key grabbing URLs, env grabbing URLs: GET /.aws/credentials.backup HTTP/1.1 G ... show more 69 attacks on password/key grabbing URLs, env grabbing URLs: GET /.aws/credentials.backup HTTP/1.1 GET /%2e%2e/%2e%2e/.env HTTP/1.1 show less	Hacking
🇺🇸 TPI-Abuse	2026-09-16 02:43:13 (21 hours ago)	(mod_security) mod_security (id:210492) triggered by 3.228.14.80 (ec2-3-228-14-80.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.228.14.80 (ec2-3-228-14-80.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 22:43:09.775706 2026] [security2:error] [pid 1425:tid 1425] [client 3.228.14.80:38372] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.54"] [uri "/static../.env"] [unique_id "aqoCPWkDN9sK-HdEBU6tdAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-16 02:43:12 (21 hours ago)	CrowdSec blocked IP for crowdsecurity/http-path-traversal-probing on localhost	Web App Attack
🇳🇱 Alt255	2026-09-16 02:34:56 (21 hours ago)	[ti-03ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ... show more [ti-03ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 3.228.14.80 - - [16/Sep/2026:04:34:35 +0200] "GET /static../.env HTTP/1.1" 404 363 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot) Chrome/122.0.6881.173 Mobile Safari/537.36" 3.228.14.80 - - [16/Sep/2026:04:34:35 +0200] "GET /media../.env HTTP/1.1" 404 363 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; LinkedInBot/1.0; +http://www.linkedin.com) Chrome/133.0.4080.169 Safari/537.36 Edg/133.0.4080.169" 3.228.14.80 - - [16/Sep/2026:04:34:35 +0200] "GET /.azure/credentials HTTP/1.1" 404 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.18) ... show less	Bad Web Bot Web App Attack
🇬🇧 gurnip	2026-09-16 02:34:37 (21 hours ago)	Vulnerability probe of page /static../.env, not found on server.	Brute-Force Web App Attack
🇺🇸 its101	2026-09-16 02:30:12 (21 hours ago)	Automated detection by LockdownAccess security system. Attack type(s): env_grab, rce, path_traversal ... show more Automated detection by LockdownAccess security system. Attack type(s): env_grab, rce, path_traversal, scanner, framework_probe, git_exposure, config_probe, wp_probe, data_exposure. Reason: Nginx: env_grab attack. Path targeted: unknown. Blocked in Cloudflare. show less	Web App Attack Exploited Host Bad Web Bot
🇪🇸 robotstxt	2026-09-16 02:27:43 (21 hours ago)	3.228.14.80 - - [16/Sep/2026:02:27:39 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 693 "-" ... show more 3.228.14.80 - - [16/Sep/2026:02:27:39 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot) Chrome/126.0.6897.93 Safari/537.36 Edg/126.0.6897.93" "-" edge="3.228.14.80" 3.228.14.80 - - [16/Sep/2026:02:27:39 +0000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0) Chrome/124.0.1849.8 Safari/537.36" "-" edge="3.228.14.80" 3.228.14.80 - - [16/Sep/2026:02:27:40 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.15) Gecko/20100101 Firefox/133.15; compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot" "-" edge="3.228.14.80" 3.228.14.80 - - [16/Sep/2026:02:27:41 +0000] "GET /media../etc/passwd HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Windows NT 11.0; Win6 ... show less	Web Spam Web App Attack
🇳🇱 donarev419	2026-09-16 02:27:21 (21 hours ago)	Connection to port 8000 with data transfer. Data preview: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (W ... show more Connection to port 8000 with data transfer. Data preview: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik show less	Port Scan Hacking
🇺🇸 heyzg	2026-09-16 02:26:09 (21 hours ago)	HTTP secret_harvesting (observed): 664 HTTP, 2.8m	Brute-Force
🇦🇺 LiftUp Hosting	2026-09-16 02:22:02 (21 hours ago)	Honeypot hit: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8) A ... show more Honeypot hit: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bytespider; +https://zhanzhang.toutiao.com/) Chrome/120.0.1809.57 Mobile Safari/537.36 Accept-Encoding: gzip; 8000 [2] TCP show less	Hacking Bad Web Bot
🇷🇺 Mga Admin	2026-09-16 02:20:08 (22 hours ago)	3.228.14.80 - - [16/Sep/2026:09:20:07 +0700] "GET /assets../../../etc/passwd HTTP/1.1" 400 226 "-" " ... show more 3.228.14.80 - - [16/Sep/2026:09:20:07 +0700] "GET /assets../../../etc/passwd HTTP/1.1" 400 226 "-" "Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.2500.30 Mobile Safari/537.36; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot" ... show less	Web App Attack
🇫🇷 Octopuce	2026-09-16 02:20:05 (22 hours ago)	Aggressive web search of vulnerable pages: /static../.env /media../.env /app/.env /.env.local /.env ... show more Aggressive web search of vulnerable pages: /static../.env /media../.env /app/.env /.env.local /.env ... show less	Web App Attack

Showing 1 to 15 of 101 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 8.219.215.242

🇦🇺 220.240.89.107

🇺🇸 216.194.87.100

🇺🇸 216.25.89.140

🇵🇦 200.46.151.238

🇦🇷 190.173.135.52

🇺🇸 162.216.150.218

🇹🇭 134.236.19.1

🇨🇳 122.137.28.6

🇨🇳 117.50.122.20

🇧🇩 103.158.249.130

🇯🇴 91.186.250.186

🇫🇷 85.217.140.41

🇬🇧 62.105.96.2

🇭🇰 42.200.158.230

🇸🇳 41.214.10.178

🇹🇼 34.80.42.181

🇩🇪 8.211.43.157

🇨🇳 223.112.202.184

🇨🇳 218.90.217.2