JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.85.27.153

3.85.27.153 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 60%: ?

60%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-85-27-153.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.85.27.153

Whois 3.85.27.153

IP Abuse Reports for 3.85.27.153:

This IP address has been reported a total of 12 times from 10 distinct sources. 3.85.27.153 was first reported on October 28th 2023, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇱🇻 garmtech.com	2026-07-26 04:49:29 (5 hours ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇫🇷 masterguru	2026-07-26 03:37:06 (6 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)	Hacking Web App Attack
🇩🇪 LRob	2026-07-26 02:37:17 (7 hours ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5. ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Hacking
🇺🇸 TPI-Abuse	2026-07-25 03:41:08 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 3.85.27.153 (ec2-3-85-27-153.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.85.27.153 (ec2-3-85-27-153.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 23:41:04.803439 2026] [security2:error] [pid 759211:tid 759211] [client 3.85.27.153:49908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "buffaloweddingdeejay.com"] [uri "/.git/config"] [unique_id "amQwUAh1k3RZ6wBheS106QAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 01:58:03 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 3.85.27.153 (ec2-3-85-27-153.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.85.27.153 (ec2-3-85-27-153.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 21:57:56.530698 2026] [security2:error] [pid 14629:tid 14629] [client 3.85.27.153:57180] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "budpowellbio.com"] [uri "/.git/config"] [unique_id "amQYJJdgG8Qi1o6ZjmEjQQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-25 00:41:11 (1 day ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
Anonymous	2026-07-24 23:18:13 (1 day ago)	(caddyscan) Scanner path probe from 3.85.27.153 (US/United States/ec2-3-85-27-153.compute-1.amazonaw ... show more (caddyscan) Scanner path probe from 3.85.27.153 (US/United States/ec2-3-85-27-153.compute-1.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 3.85.27.153 - - [24/Jul/2026:23:18:08 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 3.85.27.153 - - [24/Jul/2026:23:18:08 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 3.85.27.153 - - [24/Jul/2026:23:18:08 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 3.85.27.153 - - [24/Jul/2026:23:18:09 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 3.85.27.153 - - [24/Jul/2026:23:18:09 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇳🇱 debestelapp	2026-07-24 07:40:06 (2 days ago)		Web App Attack
🇺🇸 helios.live	2026-07-24 06:18:40 (2 days ago)	2026/07/24 06:18:39 [error] 1734348#1734348: 2605245 FastCGI sent in stderr: "Primary script unknow ... show more 2026/07/24 06:18:39 [error] 1734348#1734348: 2605245 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 3.85.27.153, server: huginn.kocerroxy.com, request: "GET / HTTP/2.0", upstream: "fastcgi://unix:/var/run/php/php8.3-fpm.sock:", host: "huginn.kocerroxy.com" 2026/07/24 06:18:39 [error] 1734348#1734348: 2605245 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 3.85.27.153, server: huginn.kocerroxy.com, request: "POST / HTTP/2.0", upstream: "fastcgi://unix:/var/run/php/php8.3-fpm.sock:", host: "huginn.kocerroxy.com" 2026/07/24 06:18:39 [error] 1734348#1734348: 2605245 access forbidden by rule, client: 3.85.27.153, server: huginn.kocerroxy.com, request: "GET /.env.local HTTP/2.0", host: "huginn.kocerroxy.com" 2026/07/24 06:18:39 [error] 1734348#1734348: *2605245 access forbidden by rule, client: 3.85.27.153, server: huginn.kocerroxy.com, request: "GET /.env.production HTTP/2.0", hos ... show less	Web App Attack
🇮🇹 VHosting	2026-07-24 04:15:04 (2 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 cwytech	2026-07-24 03:49:01 (2 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-login-lockdown-high.	Bad Web Bot Web App Attack
🇨🇭 backslash	2023-10-28 12:15:01 (2 years ago)	block ruleset bad bot: misc bad content F608233CC4C86EE814CE8DDDA9C4A0D3C79882F6	Bad Web Bot

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a09:bac5:636c:aa:0:11:177:0

🇬🇧 2a06:4883:d000::ef

🇳🇱 195.178.110.103

🇮🇩 182.10.131.142

🇷🇸 178.220.136.26

🇭🇰 156.224.77.201

🇪🇬 156.211.117.157

🇻🇳 58.186.20.143

🇸🇬 47.128.110.51

🇧🇷 45.205.1.241

🇵🇭 27.110.166.67

🇺🇸 5.253.38.188

🇺🇸 165.227.50.5

🇧🇷 143.137.88.84

🇷🇴 92.118.39.49

🇷🇴 2.57.122.238

🇦🇴 193.163.125.11

🇧🇷 170.80.65.140

🇺🇸 162.216.149.190

🇦🇪 91.73.32.240