JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.252.97.39

3.252.97.39 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 45%: ?

45%

ISP	Amazon Data Services Ireland Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-252-97-39.eu-west-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇪 Ireland
City	Dublin, Leinster

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.252.97.39

Whois 3.252.97.39

IP Abuse Reports for 3.252.97.39:

This IP address has been reported a total of 15 times from 12 distinct sources. 3.252.97.39 was first reported on July 24th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 (2 weeks ago)	Apache probe; attempts=422; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=422; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.fly \| /.env.json \| /.env.live \| /.env.local \| /.env.neon \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.railway \| /.env.remote \| /.env.render \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.supabase \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.vault \| /.env.vercel \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| ... [211 exact paths total] show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-07-27 12:26:55 (2 weeks ago)	(modsecurity) srv102 ModSecurity 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazonaws ... show more (modsecurity) srv102 ModSecurity 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
Anonymous	2026-07-27 12:20:28 (2 weeks ago)	(caddyscan) Scanner path probe from 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazon ... show more (caddyscan) Scanner path probe from 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:12:20:25 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:12:20:25 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:12:20:25 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:12:20:25 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:12:20:26 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
Anonymous	2026-07-27 11:14:54 (2 weeks ago)	(caddyscan) Scanner path probe from 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazon ... show more (caddyscan) Scanner path probe from 3.252.97.39 (IE/Ireland/ec2-3-252-97-39.eu-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:11:14:53 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:11:14:53 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:11:14:53 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:11:14:53 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 3.252.97.39 - - [27/Jul/2026:11:14:53 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇩🇪 filstal.org	2026-07-27 09:37:28 (2 weeks ago)	Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ... show more Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths. show less	Hacking Brute-Force Web App Attack
🇳🇱 Savvii	2026-07-27 00:31:09 (3 weeks ago)	20 attempts against mh-misbehave-ban on redirect	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-25 22:08:21 (3 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-24. show less	Web App Attack SSH Hacking
🇫🇷 ol.st	2026-07-25 05:43:29 (3 weeks ago)	This IP accessed the path /.env.staging from Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/5 ... show more This IP accessed the path /.env.staging from Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36, which is banned. Powered by ListenCaddy show less	Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-24 22:01:09 (3 weeks ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
Anonymous	2026-07-24 17:05:47 (3 weeks ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
🇸🇪 vaia.cloud	2026-07-24 15:45:01 (3 weeks ago)	crowdsecurity/http-crawl-non_statics	Brute-Force Web App Attack
🇫🇷 ol.st	2026-07-24 09:37:15 (3 weeks ago)	This IP accessed the path /.env.production from Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi ... show more This IP accessed the path /.env.production from Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36, which is banned. Powered by ListenCaddy show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 09:26:29 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 3.252.97.39 (ec2-3-252-97-39.eu-west-1.compute. ... show more (mod_security) mod_security (id:210492) triggered by 3.252.97.39 (ec2-3-252-97-39.eu-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:26:24.158693 2026] [security2:error] [pid 2422800:tid 2422800] [client 3.252.97.39:44450] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ols.e-zschedule.com"] [uri "/.git/config"] [unique_id "amMvwL6V0x0Ot2vnVfxsfwAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-07-24 06:29:33 (3 weeks ago)	Aggressive web search of vulnerable pages: / /.env /.env.local /app/.env /apps/.env ...	Web App Attack
🇮🇹 VHosting	2026-07-24 05:00:04 (3 weeks ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.248

🇧🇪 198.235.24.243

🇺🇸 172.71.194.24

🇻🇳 123.27.3.39

🇨🇳 111.7.96.166

🇬🇧 104.207.52.79

🇺🇸 20.14.94.72

🇸🇦 5.245.61.254

🇨🇳 221.239.90.67

🇹🇼 198.235.24.40

🇺🇸 172.56.165.14

🇧🇷 160.238.144.252

🇨🇳 111.7.96.161

🇮🇳 103.181.108.10

🇮🇳 103.98.63.228

🇸🇪 95.193.193.211

🇺🇦 91.214.136.147

🇳🇱 45.148.10.157

🇺🇸 20.163.30.209

🇳🇱 2a0b:8bc0:2:2433::1