AbuseIPDB » 3.38.172.135
3.38.172.135
This IP was reported 7 times. Confidence of
Abuse
is 47% : ?
ISP
AWS Asia Pacific (Seoul) Region
Usage Type
Data Center/Web Hosting/Transit
ASN
AS16509
Hostname(s)
ec2-3-38-172-135.ap-northeast-2.compute.amazonaws.com
Domain Name
amazon.com
Country
🇰🇷
Korea (the Republic of)
City
Incheon, Incheon
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 3.38.172.135 :
This IP address has been reported a total of
7
times from
7 distinct
sources.
3.38.172.135 was first reported on
July 27th 2026 , and the most recent report was
10 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
2026-07-29 07:00:00
(10 hours ago)
Apache probe; attempts=621; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.en ...
show more
Apache probe; attempts=621; exact paths: /.env | /.env.backup | /.env.backup1 | /.env.backup2 | /.env.bak | /.env.ci | /.env.dev | /.env.development | /.env.dist | /.env.docker | /.env.example | /.env.fly | /.env.json | /.env.live | /.env.local | /.env.neon | /.env.old | /.env.preprod | /.env.prod | /.env.production | /.env.railway | /.env.remote | /.env.render | /.env.sample | /.env.save | /.env.stage | /.env.staging | /.env.supabase | /.env.swp | /.env.test | /.env.txt | /.env.uat | /.env.vault | /.env.vercel | /.env.yaml | /.env.yml | /.env~ | /.git/.env | /.git/config | /actions/.env | /admin-panel/.env | /admin/.env | /administrator/.env | /angular/.env | /ansible/.env | /api/.env | /api/dev/.env | /api/staging/.env | /api/v1/.env | /api/v2/.env | /api/v3/.env | /app/.env | /application/.env | /apps/.env | /assets/.env | /aws/.env | /azure/.env | /backend/.env | /backup/.env | /backups/.env | /beta/.env | ... [211 exact paths total]
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-07-27 22:05:41
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-07-27 21:59:25
(1 day ago)
Auto-ban: >3000 req/min op 2026-07-27
Web App Attack
SSH
Hacking
🇮🇹
VHosting
2026-07-27 21:50:03
(1 day ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇫🇮
pixiekat
2026-07-27 18:54:57
(1 day ago)
[Mon Jul 27 19:54:52.176063 2026] [security2:error] [pid 3334545:tid 3334636] [client 3.38.172.135:4 ...
show more
[Mon Jul 27 19:54:52.176063 2026] [security2:error] [pid 3334545:tid 3334636] [client 3.38.172.135:43646] ModSecurity: Access denied with code 403 (phase 1). Pattern match ".+" at REQUEST_HEADERS:Next-Action. [file "/mnt/HC_Volume_105148208/crs/crs-custom.conf"] [line "140"] [id "9000100"] [msg "Next.js Server Action probe blocked (no Next.js apps on this server)"] [tag "custom/next-action-recon"] [hostname "www.spacecadetgrrl.me"] [uri "/"] [unique_id "amepfKWOoqUhKjxFPN9M3AAAAVQ"]
[Mon Jul 27 19:54:55.156607 2026] [security2:error] [pid 3334545:tid 3334632] [client 3.38.172.135:43658] ModSecurity: Access denied with code 403 (phase 1). Pattern match ".+" at REQUEST_HEADERS:Next-Action. [file "/mnt/HC_Volume_105148208/crs/crs-custom.conf"] [line "140"] [id "9000100"] [msg "Next.js Server Action probe blocked (no Next.js apps on this server)"] [tag "custom/next-action-recon"] [hostname "www.spacecadetgrrl.me"] [uri "/"] [unique_id "amepf6WOoqUhKjxFPN9M3QAAAVA"]
[Mon Jul 27 19:54:56.127
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-27 16:36:34
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 3.38.172.135 (ec2-3-38-172-135.ap-northeast-2.c ...
show more
(mod_security) mod_security (id:210492) triggered by 3.38.172.135 (ec2-3-38-172-135.ap-northeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 12:36:27.247728 2026] [security2:error] [pid 2270412:tid 2270496] [client 3.38.172.135:39802] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.soyjuantrece.com.emehache.net"] [uri "/.git/config"] [unique_id "ameJCwZ_F_MW4ja9YAslCQAAAQQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
INTEQ
2026-07-27 14:36:49
(2 days ago)
Web attack from 3.38.172.135
Web App Attack
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: