JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.91.45.214

3.91.45.214 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 66%: ?

66%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-91-45-214.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.91.45.214

Whois 3.91.45.214

IP Abuse Reports for 3.91.45.214:

This IP address has been reported a total of 12 times from 11 distinct sources. 3.91.45.214 was first reported on August 21st 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-08-23 22:03:49 (1 day ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-08-22. show less	Web App Attack SSH Hacking
🇺🇸 nekoify	2026-08-23 19:46:39 (1 day ago)	IP has triggered Cloudflare WAF. action: managed_challenge source: botFight clientAsn: 14618 clientA ... show more IP has triggered Cloudflare WAF. action: managed_challenge source: botFight clientAsn: 14618 clientASNDescription: Amazon.com, Inc. clientCountryName: US clientIP: 3.91.45.214 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPath: /docs/phpinfo.php clientRequestQuery: datetime: 2026-08-23T19:46:39Z rayName: a2fc9fe31b5b0132 ruleId: bot_fight_mode userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36. show less	Open Proxy VPN IP Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
🇭🇺 miszterx.hu	2026-08-23 10:43:33 (1 day ago)	XORP (haproxy): 255x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_i ... show more XORP (haproxy): 255x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu) show less	Web App Attack
🇫🇷 Octopuce	2026-08-23 06:41:40 (1 day ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇧🇪 cmbplf	2026-08-23 03:04:04 (1 day ago)	10.262 4xx requests in 1 hour (2w2d23h)	Brute-Force Bad Web Bot
🇳🇴 jad-abuse	2026-08-23 00:33:41 (2 days ago)	ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_expos ... show more ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: git_exposure, env_probe, source_backup, server_status, wp_admin. Observed by 1 sensor(s); 261 hits. show less	Brute-Force Web App Attack
🇳🇱 e.fierstra	2026-08-22 18:39:20 (2 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-22 18:30:07 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 3.91.45.214 (ec2-3-91-45-214.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.91.45.214 (ec2-3-91-45-214.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 22 14:30:01.386575 2026] [security2:error] [pid 22659:tid 22668] [client 3.91.45.214:52108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "missmadlove.com"] [uri "/.git/config"] [unique_id "aonqqVFL34XyOU1hALJaHgAAAUY"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 Klaverstyn	2026-08-22 15:16:35 (2 days ago)	Cross-vhost secrets/RCE probing campaign	Web App Attack Hacking
🇬🇧 Apache	2026-08-22 07:05:02 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 3.91.45.214 (US/United States/ec2-3-91-45-214.c ... show more (mod_security) mod_security (id:210492) triggered by 3.91.45.214 (US/United States/ec2-3-91-45-214.compute-1.amazonaws.com): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-21 23:55:10 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 3.91.45.214 (ec2-3-91-45-214.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.91.45.214 (ec2-3-91-45-214.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 21 19:55:06.877080 2026] [security2:error] [pid 26214:tid 26214] [client 3.91.45.214:55570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mccachren.org"] [uri "/.git/config"] [unique_id "aojlWuLLiDF6bbNNIZ5eAQAAAC0"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 zynex	2026-08-21 14:09:12 (3 days ago)	URL Probing: /server/.env	Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇪 2400:cb00:1030:1000:a42b:2424:4616:931f

🇧🇪 198.235.24.140

🇬🇧 193.163.125.132

🇧🇷 187.50.194.182

🇳🇱 178.128.252.50

🇺🇸 162.216.150.96

🇺🇸 150.107.38.98

🇻🇳 116.108.249.125

🇩🇪 104.22.79.48

🇺🇸 91.230.168.249

🇳🇱 89.248.167.131

🇩🇴 45.235.229.124

🇺🇸 20.118.133.132

🇺🇸 216.25.89.83

🇧🇷 205.210.31.165

🇺🇸 168.62.48.100

🇺🇸 74.125.185.85

🇪🇨 45.238.57.138

🇧🇪 35.240.64.219

🇺🇸 34.139.13.182