JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.239.202.201

3.239.202.201 was found in our database!

This IP was reported 73 times. Confidence of Abuse is 0%: ?

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-239-202-201.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.239.202.201

Whois 3.239.202.201

IP Abuse Reports for 3.239.202.201:

This IP address has been reported a total of 73 times from 45 distinct sources. 3.239.202.201 was first reported on December 5th 2025, and the most recent report was 7 months ago.

Old Reports: The most recent abuse report for this IP address is from 7 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2025-12-11 03:17:34 (7 months ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇫🇷 dynamix	2025-12-11 03:11:30 (7 months ago)	Multiple WAF Violations	Web App Attack
🇩🇪 paissangroup	2025-12-11 03:04:14 (7 months ago)	Multiple WAF Violations	Web App Attack
🇦🇺 aranguren.org	2025-12-11 03:03:36 (7 months ago)	3.239.202.201 - - [11/Dec/2025:14:03:33 +1100] "GET /.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; L ... show more 3.239.202.201 - - [11/Dec/2025:14:03:33 +1100] "GET /.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:14:03:34 +1100] "GET /app/.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:14:03:34 +1100] "GET /config/.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:14:03:34 +1100] "GET /api/.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:14:03:35 +1100] "GET /admin/.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:14:03:35 +1100] "GET /backend/.env HTTP/1.1" 404 985 "-" "Mozilla/5.0 (X11; Linux x86_64)" ... show less	Bad Web Bot
🇧🇪 taivas.nl	2025-12-11 03:02:10 (7 months ago)	Bad_requests	Bad Web Bot
🇪🇸 Francisco Vallejo	2025-12-11 02:57:50 (7 months ago)	[Thu Dec 11 03:57:34.515319 2025] [authz_core:error] [pid 1470271:tid 127275550881472] [client 3.239 ... show more [Thu Dec 11 03:57:34.515319 2025] [authz_core:error] [pid 1470271:tid 127275550881472] [client 3.239.202.201:58344] AH01630: client denied by server configuration: proxy:http://127.0.0.1:1780/, referer: http://audio.franvallejo.es [Thu Dec 11 03:57:34.861205 2025] [authz_core:error] [pid 1470271:tid 127277100680896] [client 3.239.202.201:58344] AH01630: client denied by server configuration: proxy:http://127.0.0.1:1780/.env, referer: http://audio.franvallejo.es/.env [Thu Dec 11 03:57:35.125507 2025] [authz_core:error] [pid 1470271:tid 127276960167616] [client 3.239.202.201:58344] AH01630: client denied by server configuration: proxy:http://127.0.0.1:1780/app/.env, referer: http://audio.franvallejo.es/app/.env [Thu Dec 11 03:57:35.411934 2025] [authz_core:error] [pid 1470271:tid 127277083895488] [client 3.239.202.201:58344] AH01630: client denied by server configuration: proxy:http://127.0.0.1:1780/config/.env, referer: http://audio.franvallejo.es/config/.env [Thu Dec 11 03:57:35.675020 ... show less	Brute-Force SSH
🇬🇧 Apache	2025-12-11 02:49:24 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 3.239.202.201 (US/United States/ec2-3-239-202-2 ... show more (mod_security) mod_security (id:210492) triggered by 3.239.202.201 (US/United States/ec2-3-239-202-201.compute-1.amazonaws.com): 5 in the last 300 secs show less	Brute-Force Web App Attack
🇩🇪 DocNetzwerk	2025-12-11 02:45:16 (7 months ago)	(mod_security) mod_security triggered on hostname [redacted] 3.239.202.201 (US/United States/ec2-3-2 ... show more (mod_security) mod_security triggered on hostname [redacted] 3.239.202.201 (US/United States/ec2-3-239-202-201.compute-1.amazonaws.com) show less	SQL Injection
🇺🇸 Eric Bellomo	2025-12-11 02:44:29 (7 months ago)	3.239.202.201 - - [11/Dec/2025:02:44:28 +0000] "GET / HTTP/1.1" 403 13 3.239.202.201 - - [11/Dec/202 ... show more 3.239.202.201 - - [11/Dec/2025:02:44:28 +0000] "GET / HTTP/1.1" 403 13 3.239.202.201 - - [11/Dec/2025:02:44:28 +0000] "GET /.env HTTP/1.1" 403 13 3.239.202.201 - - [11/Dec/2025:02:44:28 +0000] "GET /app/.env HTTP/1.1" 403 13 3.239.202.201 - - [11/Dec/2025:02:44:29 +0000] "GET /config/.env HTTP/1.1" 403 13 ... show less	Port Scan Bad Web Bot
🇦🇺 screwlooseit.com.au	2025-12-11 02:43:21 (7 months ago)	Blocked by CSF 13 firewall - Rule: config-dotfile US/United States/ec2-3-239-202-201.compute-1.amazo ... show more Blocked by CSF 13 firewall - Rule: config-dotfile US/United States/ec2-3-239-202-201.compute-1.amazonaws.com show less	Web App Attack
🇩🇪 LRob	2025-12-11 02:32:54 (7 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇩🇪 Hary74656	2025-12-11 02:31:11 (7 months ago)	[Thu Dec 11 03:31:01.087921 2025] [security2:error] [pid 420803:tid 420881] [client 3.239.202.201:52 ... show more [Thu Dec 11 03:31:01.087921 2025] [security2:error] [pid 420803:tid 420881] [client 3.239.202.201:52146] [client 3.239.202.201] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "auge.weavernet.at"] [uri "/.env"] [unique_id "aTos5ZFF85PWSnXiDvclwwAAA48"] [Thu Dec 11 03:31:01.250904 2025] [security2:error] [pid 420803:tid 420883] [client 3.239.202.201:52146] [client 3.239.202.201] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/mods ... show less	Web App Attack
🇺🇦 URAN Publishing Service	2025-12-11 02:26:40 (7 months ago)	3.239.202.201 - - [11/Dec/2025:04:26:38 +0200] "GET /.env HTTP/1.1" 404 301 "http://artmind.ndiu.org ... show more 3.239.202.201 - - [11/Dec/2025:04:26:38 +0200] "GET /.env HTTP/1.1" 404 301 "http://artmind.ndiu.org.ua/.env" "Mozilla/5.0 (X11; Linux x86_64)" 3.239.202.201 - - [11/Dec/2025:04:26:39 +0200] "GET /app/.env HTTP/1.1" 404 2855 "http://artmind.ndiu.org.ua/app/.env" "Mozilla/5.0 (X11; Linux x86_64)" ... show less	Web App Attack
🇪🇸 masterguru	2025-12-11 02:23:00 (7 months ago)	BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (110 ... show more BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:User-Agent. (1100000-123) show less	Bad Web Bot
🇩🇪 Bedios GmbH	2025-12-10 03:11:40 (7 months ago)	Login credentials theft attempt	Hacking

Showing 1 to 15 of 73 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 217.155.75.149

🇻🇪 201.222.1.29

🇳🇱 185.2.80.252

🇨🇳 163.142.179.22

🇸🇬 45.82.78.102

🇨🇿 194.87.126.72

🇧🇴 181.188.148.74

🇵🇰 175.107.233.152

🇮🇹 158.173.77.102

🇩🇪 47.254.181.23

🇬🇧 35.203.211.140

🇷🇴 141.98.83.48

🇹🇼 114.24.164.128

🇩🇪 104.28.162.58

🇬🇧 45.82.76.112

🇨🇳 183.184.55.207

🇺🇸 172.238.160.104

🇺🇸 157.245.3.50

🇨🇦 148.113.130.59

🇸🇬 145.223.140.149