JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

3.95.39.105

Neutral Activity

Abuse confidence score ?

0% Low Risk

17 reports

11 reporters · latest 2 months ago

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-3-95-39-105.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

3.95.39.105 has been reported 17 times. The most recent report is from 2 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 3.95.39.105

Export CSV

This IP address has been reported a total of 17 times from 11 distinct sources. 3.95.39.105 was first reported on July 24th 2026, and the most recent report was 2 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 (2 months ago)	Apache probe; attempts=866; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=866; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.fly \| /.env.json \| /.env.live \| /.env.local \| /.env.neon \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.railway \| /.env.remote \| /.env.render \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.supabase \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.vault \| /.env.vercel \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| ... [211 exact paths total] show less	Web App Attack
🇳🇱 debestelapp	2026-07-28 05:25:05 (2 months ago)		Web App Attack
🇫🇷 ol.st	2026-07-28 02:15:13 (2 months ago)	This IP accessed the path /.env from Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537 ... show more This IP accessed the path /.env from Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36, which is banned. Powered by ListenCaddy show less	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-07-27 12:55:59 (2 months ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-196)	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 12:55:24 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 3.95.39.105 (ec2-3-95-39-105.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.95.39.105 (ec2-3-95-39-105.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 08:55:18.009312 2026] [security2:error] [pid 3704080:tid 3704080] [client 3.95.39.105:57120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "origenial.com"] [uri "/.git/config"] [unique_id "amdVNiAvkCYqDlA4zhvqYwAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-07-27 12:05:05 (2 months ago)	Scanning/Probing (33)	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-26 03:42:00 (2 months ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 mnsf	2026-07-26 01:05:13 (2 months ago)	Too many Status 40X (26) Scanning/Probing (26)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 19:47:25 (2 months ago)	(mod_security) mod_security (id:210492) triggered by 3.95.39.105 (ec2-3-95-39-105.compute-1.amazonaw ... show more (mod_security) mod_security (id:210492) triggered by 3.95.39.105 (ec2-3-95-39-105.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 15:47:17.819280 2026] [security2:error] [pid 2790905:tid 2790905] [client 3.95.39.105:44778] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ratbird.com.markgiffin.com"] [uri "/.git/config"] [unique_id "amUSxdCy7dNN67Q9c9wPLQAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 hchristo	2026-07-25 16:51:27 (2 months ago)	[Sat Jul 25 18:51:26.066551 2026] [proxy_fcgi:error] [pid 44339:tid 44411] [client 3.95.39.105:39980 ... show more [Sat Jul 25 18:51:26.066551 2026] [proxy_fcgi:error] [pid 44339:tid 44411] [client 3.95.39.105:39980] AH01071: Got error 'Primary script unknown' [Sat Jul 25 18:51:26.160324 2026] [proxy_fcgi:error] [pid 44339:tid 44440] [client 3.95.39.105:39980] AH01071: Got error 'Primary script unknown' [Sat Jul 25 18:51:26.254217 2026] [proxy_fcgi:error] [pid 44339:tid 44409] [client 3.95.39.105:39980] AH01071: Got error 'Primary script unknown' [Sat Jul 25 18:51:26.347747 2026] [proxy_fcgi:error] [pid 44339:tid 44400] [client 3.95.39.105:39980] AH01071: Got error 'Primary script unknown' [Sat Jul 25 18:51:26.441729 2026] [proxy_fcgi:error] [pid 44339:tid 44432] [client 3.95.39.105:39980] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force
🇳🇿 Antinson	2026-07-25 14:58:06 (2 months ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇳🇱 Site.eu	2026-07-25 01:10:17 (2 months ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 mnsf	2026-07-25 00:05:57 (2 months ago)	Too many Status 40X (41) Scanning/Probing (41)	Brute-Force Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-24 22:04:18 (2 months ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇳🇱 WeCloudit-Anti-Abuse	2026-07-24 18:08:14 (2 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 124.90.54.79

🇳🇱 109.160.32.165

🇳🇱 109.160.32.125

🇸🇬 85.203.23.21

🇺🇸 72.168.93.223

🇸🇬 35.198.226.114

🇳🇱 172.235.181.226

🇩🇪 116.203.34.38

🇳🇱 77.239.124.69

🇳🇱 77.91.71.90

🇺🇸 47.251.105.107

🇸🇬 47.128.33.95

🇮🇷 45.159.197.253

🇮🇳 34.100.248.63

🇹🇼 223.142.12.133

🇨🇳 218.78.132.164

🇮🇶 212.237.122.168

🇧🇷 201.139.186.238

🇳🇱 195.178.110.227

🇬🇧 193.163.125.142