JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.38.194.99

3.38.194.99 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 57%: ?

57%

ISP	AWS Asia Pacific (Seoul) Region
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-3-38-194-99.ap-northeast-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇰🇷 Korea (the Republic of)
City	Incheon, Incheon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.38.194.99

Whois 3.38.194.99

IP Abuse Reports for 3.38.194.99:

This IP address has been reported a total of 14 times from 11 distinct sources. 3.38.194.99 was first reported on February 12th 2022, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 (1 day ago)	Apache probe; attempts=422; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=422; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.fly \| /.env.json \| /.env.live \| /.env.local \| /.env.neon \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.railway \| /.env.remote \| /.env.render \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.supabase \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.vault \| /.env.vercel \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| ... [211 exact paths total] show less	Web App Attack
🇳🇱 Mangelot Hosting	2026-07-28 04:52:10 (2 days ago)	(modsecurity) srv101 ModSecurity 3.38.194.99 (KR/South Korea/ec2-3-38-194-99.ap-northeast-2.compute. ... show more (modsecurity) srv101 ModSecurity 3.38.194.99 (KR/South Korea/ec2-3-38-194-99.ap-northeast-2.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇬🇧 consul.to	2026-07-28 04:20:45 (2 days ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 dynamix	2026-07-27 11:10:57 (2 days ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 02:05:03 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.com ... show more (mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 22:04:56.894605 2026] [security2:error] [pid 3764200:tid 3764200] [client 3.38.194.99:54376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "veneerdent.com"] [uri "/.git/config"] [unique_id "ama8yHb1bVE47blfSKQ3bAAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 mail.avx.gr	2026-07-23 11:31:21 (6 days ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 3.38.194.99 - - [17/Jul/2026:23:13:23 +0300] "GET ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 3.38.194.99 - - [17/Jul/2026:23:13:23 +0300] "GET /.env.txt HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Web App Attack
🇳🇱 Site.eu	2026-07-18 01:47:13 (1 week ago)	Excessive 404/403 errors	Brute-Force
🇫🇷 mail.avx.gr	2026-07-17 20:13:23 (1 week ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 3.38.194.99 - - [17/Jul/2026:23:13:23 +0300] "GET ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 3.38.194.99 - - [17/Jul/2026:23:13:23 +0300] "GET /.env.txt HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Web App Attack
Anonymous	2026-07-17 08:20:04 (1 week ago)	\| [Dangerous/South Korea] Aggressive IP 3.38.194.99 (~30 hits). Type: DoS Defender- Web server 400 e ... show more \| [Dangerous/South Korea] Aggressive IP 3.38.194.99 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-07-17 08:17:15 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.com ... show more (mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 04:17:06.759904 2026] [security2:error] [pid 497606:tid 497606] [client 3.38.194.99:39068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.katlin.anthonyjoseph.us"] [uri "/.git/config"] [unique_id "alnlAkdqkgPnv7Sn_gLidQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 06:20:59 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.com ... show more (mod_security) mod_security (id:210492) triggered by 3.38.194.99 (ec2-3-38-194-99.ap-northeast-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 02:20:54.546131 2026] [security2:error] [pid 7118:tid 7118] [client 3.38.194.99:45602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kathleenhazlett.seizetheseason.com"] [uri "/.git/config"] [unique_id "alnJxjNnO41JcM7ZrXbxzgAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-16 22:01:17 (1 week ago)	Auto-ban: >3000 req/min op 2026-07-16	Web App Attack SSH Hacking
🇳🇱 Savvii	2026-07-16 15:58:29 (1 week ago)	20 attempts against mh_ha-misbehave-ban on yeti	Brute-Force Bad Web Bot Web App Attack
🇫🇷 jk jk	2022-02-12 00:24:58 (4 years ago)	WAF_blocked	Hacking Web App Attack

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 192.178.92.28

🇩🇪 167.94.146.38

🇻🇳 157.10.53.135

🇨🇳 139.170.73.152

🇨🇭 92.119.165.164

🇺🇸 66.132.195.61

🇺🇸 64.62.197.172

🇺🇸 64.62.197.171

🇺🇸 47.20.29.118

🇨🇳 27.8.44.168

🇸🇬 8.219.109.151

🇹🇼 198.235.24.72

🇺🇸 195.184.76.66

🇳🇱 193.47.62.167

🇺🇸 184.105.247.211

🇨🇳 175.8.112.243

🇭🇰 165.154.225.47

🇮🇳 103.81.25.179

🇧🇩 103.78.254.226

🇷🇴 92.118.39.78