JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.238.56.206

3.238.56.206 was found in our database!

This IP was reported 82 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-238-56-206.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.238.56.206

Whois 3.238.56.206

IP Abuse Reports for 3.238.56.206:

This IP address has been reported a total of 82 times from 62 distinct sources. 3.238.56.206 was first reported on November 15th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇱 spd.co.il	2026-09-17 20:05:07 (2 days ago)	Web application attack detected	Hacking Web App Attack
🇧🇪 boxed-it	2026-09-17 14:08:33 (3 days ago)	GET /@fs/../.env?raw?? (Tarpitted for 1d15h8m33s, wasted 8.06MB)	Web App Attack
🇺🇸 solantex	2026-09-17 06:05:51 (3 days ago)	HTTP reconnaissance: 5 or more 4xx responses within one second from a single source (fail2ban)	Web App Attack
Anonymous	2026-09-16 11:31:00 (4 days ago)	Vite.server.fs.deny.import.Arbitrary.File.Read Web.Server.Password.File.Access Spring.Boot.Actuato ... show more Vite.server.fs.deny.import.Arbitrary.File.Read Web.Server.Password.File.Access Spring.Boot.Actuator.Unauthorized.Access show less	Hacking
🇧🇷 SOC-BR	2026-09-16 07:20:33 (4 days ago)	Attack detected by Fortinet - applications3: Vite.server.fs.deny.raw.Arbitrary.File.Read - 2026-09-1 ... show more Attack detected by Fortinet - applications3: Vite.server.fs.deny.raw.Arbitrary.File.Read - 2026-09-15 22:14:09 - Source Port 13948 show less	Port Scan Hacking
🇳🇱 Jos Moonen	2026-09-16 02:43:06 (4 days ago)	3.238.56.206 - - [16/Sep/2026:04:42:52 +0200] "GET /.env HTTP/1.1" 200 3 "-" "Mozilla/5.0 (iPhone; C ... show more 3.238.56.206 - - [16/Sep/2026:04:42:52 +0200] "GET /.env HTTP/1.1" 200 3 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; WhatsApp/10.0.2.1) Version/17.7 Mobile/15E148 Safari/604.1" 3.238.56.206 - - [16/Sep/2026:04:43:05 +0200] "GET /actuator HTTP/1.1" 200 3 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Applebot/0.1; +http://www.apple.com/go/applebot" ... show less	Web App Attack Brute-Force
🇪🇸 robotstxt	2026-09-16 02:42:53 (4 days ago)	3.238.56.206 - - [16/Sep/2026:02:42:49 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 693 "- ... show more 3.238.56.206 - - [16/Sep/2026:02:42:49 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Discordbot/2.0; +https://discordapp.com) Chrome/109.0.3351.228 Mobile Safari/537.36" "-" edge="3.238.56.206" 3.238.56.206 - - [16/Sep/2026:02:42:51 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7693.85 Safari/537.36; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot" "-" edge="3.238.56.206" 3.238.56.206 - - [16/Sep/2026:02:42:51 +0000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot) Chrome/109.0.7568.190 Mobile Safari/537.36" "-" edge="3.238.56.206" 3.238.56.206 - - [16/Sep/2026:02:42:51 +0000] "GET /static../.azure/creden ... show less	Web Spam Web App Attack
🇧🇾 lns.bz	2026-09-16 02:42:48 (4 days ago)	.env scanning [BY]	Web App Attack
🇳🇱 donarev419	2026-09-16 02:42:36 (4 days ago)	Connection to port 8000 with data transfer. Data preview: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (M ... show more Connection to port 8000 with data transfer. Data preview: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/605.1.15 (KHT show less	Port Scan Hacking
🇺🇸 001hermes	2026-09-16 02:40:58 (4 days ago)	SSH brute force / port scan blocked by fail2ban (honeypot setup)	Brute-Force SSH
🇬🇧 venus.launch.bz	2026-09-16 02:39:22 (4 days ago)	(wpscan) WordPress probe detected from 3.238.56.206 (US/United States/ec2-3-238-56-206.compute-1.ama ... show more (wpscan) WordPress probe detected from 3.238.56.206 (US/United States/ec2-3-238-56-206.compute-1.amazonaws.com) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-16 02:37:17 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 3.238.56.206 (ec2-3-238-56-206.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 3.238.56.206 (ec2-3-238-56-206.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 22:37:12.363931 2026] [security2:error] [pid 27094:tid 27094] [client 3.238.56.206:26582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.220"] [uri "/static../.env"] [unique_id "aqoA2PX7ppLsvrw5QNMnQwAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 LiftUp Hosting	2026-09-16 02:34:02 (4 days ago)	Honeypot hit: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Ap ... show more Honeypot hit: HTTP/1.1 request on 8000 GET / User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.4558.243 Safari/537.36; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user Accept-Encoding: gzip; 8000 [2] TCP show less	Hacking Bad Web Bot
🇫🇷 id2i	2026-09-16 02:26:06 (4 days ago)	2026-09-16T04:26:05.624200+02:00 coraza-spoa[262622]: [client "3.238.56.206"] Coraza: Access denied ... show more 2026-09-16T04:26:05.624200+02:00 coraza-spoa[262622]: [client "3.238.56.206"] Coraza: Access denied (phase 2). Inbound Anomaly Score Exceeded (Total Score: 8) show less	Hacking Web App Attack
🇳🇱 Alt255	2026-09-16 02:21:02 (4 days ago)	[ti-03ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ... show more [ti-03ov] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 3.238.56.206 - - [16/Sep/2026:04:20:32 +0200] "GET /.azure/credentials HTTP/1.1" 404 363 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user) Version/18.6 Mobile/15E148 Safari/604.1" 3.238.56.206 - - [16/Sep/2026:04:20:33 +0200] "GET /@fs/../.env?raw?? HTTP/1.1" 404 363 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.7934.118 Mobile Safari/537.36; compatible; Google-Extended/1.0; +http://www.google.com/bot.html" 3.238.56.206 - - [16/Sep/2026:04:20:33 +0200] "GET /static../.azure/credentials HTTP/1.1" 404 363 "-" "Mozilla/5.0 (Macintosh; In ... show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 82 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 202.155.236.242

🇩🇪 193.124.20.247

🇰🇷 168.126.36.209

🇺🇸 163.47.41.59

🇺🇸 147.185.132.153

🇳🇱 45.148.10.240

🇺🇸 3.91.159.225

🇨🇭 209.99.190.200

🇨🇳 115.190.197.138

🇮🇩 114.12.17.98

🇮🇳 103.50.5.94

🇹🇼 35.229.189.208

🇺🇸 35.196.55.242

🇺🇿 213.230.111.14

🇹🇭 203.146.251.162

🇺🇿 185.213.229.121

🇭🇰 165.154.4.210

🇲🇦 160.178.208.98

🇺🇸 136.144.35.110

🇺🇦 91.195.2.23