This IP address has been reported a total of
18
times from
13 distinct
sources.
3.99.230.79 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show moreAuto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-29.
show less
10.408 requests with url.path *.env
2.605 requests with url.path *phpinfo.php
447 requests with u ...
show more10.408 requests with url.path *.env
2.605 requests with url.path *phpinfo.php
447 requests with url.path *credentials.json
198 requests with url.path *.php.bak
129 requests with url.path *.git/*
show less
(mod_security) mod_security (id:210492) triggered by 3.99.230.79 (ec2-3-99-230-79.ca-central-1.compu ...
show more(mod_security) mod_security (id:210492) triggered by 3.99.230.79 (ec2-3-99-230-79.ca-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 06:20:11.113609 2026] [security2:error] [pid 20385:tid 20385] [client 3.99.230.79:58736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.box903.com.redondotile.com"] [uri "/.git/config"] [unique_id "amnT25jkt2Ky4sdLxE0bYwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Automated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.git/co ...
show moreAutomated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.git/config|/.env.production|/.env|/.env.local|/.env.staging|/.env.development|/.env.test|/.env.remote|(+196 more)
show less
(mod_security) mod_security triggered on hostname [redacted] 3.99.230.79 (CA/Canada/ec2-3-99-230-79. ...
show more(mod_security) mod_security triggered on hostname [redacted] 3.99.230.79 (CA/Canada/ec2-3-99-230-79.ca-central-1.compute.amazonaws.com)
show less
Automated Apache web application probing in selected 24h window; attempts=439, unique_paths=204, err ...
show moreAutomated Apache web application probing in selected 24h window; attempts=439, unique_paths=204, error_responses=408; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths.
show less