JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.238.130.183

3.238.130.183 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-238-130-183.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.238.130.183

Whois 3.238.130.183

IP Abuse Reports for 3.238.130.183:

This IP address has been reported a total of 25 times from 23 distinct sources. 3.238.130.183 was first reported on October 11th 2023, and the most recent report was 10 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Lunix	2026-08-27 19:53:49 (10 minutes ago)		Brute-Force Web App Attack
🇪🇸 alferez	2026-08-27 19:17:52 (46 minutes ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇩🇪 kommunos	2026-08-27 18:57:40 (1 hour ago)	/v1/graphql	Web App Attack
🇮🇩 zam	2026-08-27 16:49:12 (3 hours ago)	3.238.130.183 - - [27/Aug/2026:16:48:53 +0000] "POST /graphql HTTP/1.1" 404 81940 3.238.130.183 - - ... show more 3.238.130.183 - - [27/Aug/2026:16:48:53 +0000] "POST /graphql HTTP/1.1" 404 81940 3.238.130.183 - - [27/Aug/2026:16:48:54 +0000] "GET /.vite/manifest.json HTTP/1.1" 404 81940 3.238.130.183 - - [27/Aug/2026:16:48:54 +0000] "GET /dist/manifest.json HTTP/1.1" 404 81940 3.238.130.183 - - [27/Aug/2026:16:48:56 +0000] "POST /api/graphql HTTP/1.1" 404 81940 3.238.130.183 - - [27/Aug/2026:16:48:57 +0000] "POST /v1/graphql HTTP/1.1" 404 81940 {"log":"3.238.130.183 - - [27/Aug/2026:16:49:00 +0000] "GET /dist/.vite/manifest.json H show less	Web App Attack
🇩🇪 LRob	2026-08-27 16:31:28 (3 hours ago)	Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: ... show more Probing for secret files (.git, .env, credentials, database dumps, wp-config) \| method: GET \| path: /.git/config (+3 more) \| 2026-08-27 16:31 UTC show less	Hacking Web App Attack
Anonymous	2026-08-27 16:27:50 (3 hours ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /.env.bak	Web App Attack
🇩🇪 FeG Deutschland	2026-08-27 15:45:38 (4 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247	Exploited Host Web App Attack
🇵🇱 sefinek.net	2026-08-27 15:42:47 (4 hours ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action: BLOCK \| Protocol: HTTP/2 (GET) \| Endpoint: /id_ecdsa \| UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 big-cloud.nl	2026-08-27 13:44:58 (6 hours ago)	Try to access /.aws/credentials	Web App Attack
🇺🇸 mnsf	2026-08-27 12:05:18 (7 hours ago)	Abuse Detected (11)	Brute-Force Web App Attack
🇳🇴 jad-abuse	2026-08-27 11:27:40 (8 hours ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: aws_creds ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: aws_creds, git_exposure, env_probe, source_backup. Observed by 1 sensor(s); 50 hits. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-27 11:23:09 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 3.238.130.183 (ec2-3-238-130-183.compute-1.amaz ... show more (mod_security) mod_security (id:210492) triggered by 3.238.130.183 (ec2-3-238-130-183.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 07:23:02.921780 2026] [security2:error] [pid 2278205:tid 2278241] [client 3.238.130.183:60600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.pizzadlux.com"] [uri "/.git/config"] [unique_id "apAeFuKMkSny_ZVB3hfvhQAAAYA"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 netfactotum	2026-08-27 11:20:36 (8 hours ago)		Hacking Web App Attack
🇺🇦 URAN Publishing Service	2026-08-27 10:46:34 (9 hours ago)	[27/Aug/2026:13:46:34 +0300] -- 3.238.130.183 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET / ... show more [27/Aug/2026:13:46:34 +0300] -- 3.238.130.183 Ban reason: Scanner [SENSITIVE_FILES] \| Request: GET /.cursor/mcp.json HTTP/1.1 show less	Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-08-27 10:03:51 (10 hours ago)	cloudlinux2 fail2ban: 2026-08-27 11:59:21,877 fail2ban.filter [1775]: INFO [plesk-apache] ... show more cloudlinux2 fail2ban: 2026-08-27 11:59:21,877 fail2ban.filter [1775]: INFO [plesk-apache] Found 10.119.252.94 - 2026-08-27 11:59:21cloudlinux2 fail2ban: 2026-08-27 11:59:25,754 fail2ban.filter [1775]: INFO [plesk-wordpress] Found 185.251.19.134 - 2026-08-27 11:59:24cloudlinux2 fail2ban: 2026-08-27 11:59:37,517 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 103.151.156.144 - 2026-08-27 11:59:37cloudlinux2 fail2ban: 2026-08-27 11:59:58,590 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 103.151.156.144 - 2026-08-27 11:59:58cloudlinux2 fail2ban: 2026-08-27 12:00:06,680 fail2ban.filter [1775]: INFO [plesk-apache] Found 10.119.252.94 - 2026-08-27 12:00:06cloudlinux2 fail2ban: 2026-08-27 12:00:12,581 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 3.238.130.183 - 2026-08-27 12:00:12cloudlinux2 fail2ban: 2026-08-27 12:00:12,563 fail2ban.filter [1775]: INFO [plesk-modsecurity] Found 3.238.130.183 - 2026-08-27 12:00:12cl show less	Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.90.244.17

🇩🇪 196.251.121.142

🇩🇪 167.94.146.32

🇺🇸 162.159.120.141

🇺🇸 162.158.41.226

🇧🇪 34.38.64.164

🇨🇦 20.48.251.3

🇳🇿 2407:7000:ad50:4500:9154:c8cb:5c3c:2290

🇨🇱 216.155.93.75

🇱🇹 213.176.26.191

🇹🇷 188.59.178.28

🇺🇾 186.50.71.97

🇺🇦 176.103.15.169

🇨🇳 175.8.93.33

🇯🇵 172.104.100.117

🇺🇸 172.71.151.110

🇺🇸 172.71.151.109

🇺🇸 172.71.150.13

🇺🇸 172.71.147.173

🇺🇸 162.158.42.102