JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 3.221.156.96

3.221.156.96 was found in our database!

This IP was reported 2,429 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	3-221-156-96.crawl.amazonbot.amazon
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 3.221.156.96

Whois 3.221.156.96

IP Abuse Reports for 3.221.156.96:

This IP address has been reported a total of 2,429 times from 163 distinct sources. 3.221.156.96 was first reported on October 3rd 2024, and the most recent report was 29 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Mendip_Defender	2026-09-02 00:01:23 (29 minutes ago)	3.221.156.96 - - [02/Sep/2026:01:01:35 +0100] "GET /?amp&do=newreply HTTP/1.1" 301 5645 "-" "Mozilla ... show more 3.221.156.96 - - [02/Sep/2026:01:01:35 +0100] "GET /?amp&do=newreply HTTP/1.1" 301 5645 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36" ... show less	Bad Web Bot
🇫🇷 LRob	2026-09-01 19:31:59 (4 hours ago)	Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: ... show more Malicious web request: probing for secrets, traversal or a known exploit path \| method: GET \| path: /en/wp-json/wp/v2/users/1348 \| 2026-09-01 19:31 UTC show less	Hacking Web App Attack
🇩🇪 Hugopvigo	2026-08-31 21:25:05 (1 day ago)	"2026-08-31 21:25:04+00:00 3.221.156.96 IP con score alto (100) detectada en el log."	Brute-Force SSH
🇺🇸 SX Communications	2026-08-31 17:57:52 (1 day ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this add ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
Anonymous	2026-08-31 09:38:24 (1 day ago)	FortiWeb WAF: 26 attacks detected. Threat Score: 7600. Types: Client Management(13), Block IP List(1 ... show more FortiWeb WAF: 26 attacks detected. Threat Score: 7600. Types: Client Management(13), Block IP List(13). Origin: United States. show less	Web App Attack
🇵🇱 Budyn	2026-08-31 02:17:01 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.site \| URI: /backup.sql \| UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 Hugopvigo	2026-08-30 21:28:09 (2 days ago)	"2026-08-30 21:28:09+00:00 3.221.156.96 IP con score alto (100) detectada en el log."	Brute-Force SSH
🇺🇸 SX Communications	2026-08-30 13:45:55 (2 days ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this add ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇬🇷 setupgr	2026-08-30 12:16:05 (2 days ago)	(mod_security) mod_security (id:11000010) triggered by 3.221.156.96 (US/United States/Virginia/Ashbu ... show more (mod_security) mod_security (id:11000010) triggered by 3.221.156.96 (US/United States/Virginia/Ashburn/-/[AS14618 AMAZON-AES]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sun Aug 30 15:16:04.556085 2026] [security2:error] [pid 965750:tid 965780] [client 3.221.156.96:5610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Amazonbot" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "114"] [id "11000010"] [msg "BLOCKED BOT: Amazonbot on pankoskal.gr"] [severity "ALERT"] [hostname "pankoskal.gr"] [uri "/wp-content/plugins/elementor/assets/"] [unique_id "apQfBIE0QRnWEaSKP6VLcwAAAcM"] show less	Port Scan
🇵🇱 sefinek.net	2026-08-30 11:56:04 (2 days ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpo ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /gallery/nekomimi-catgirl-sailor-uniform-cityscape \| UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 Hugopvigo	2026-08-29 21:39:28 (3 days ago)	"2026-08-29 21:39:28+00:00 3.221.156.96 IP con score alto (100) detectada en el log."	Brute-Force SSH
Anonymous	2026-08-29 09:36:14 (3 days ago)	FortiWeb WAF: 24 attacks detected. Threat Score: 7200. Types: Client Management(12), Block IP List(1 ... show more FortiWeb WAF: 24 attacks detected. Threat Score: 7200. Types: Client Management(12), Block IP List(12). Origin: United States. show less	Web App Attack
🇺🇸 SX Communications	2026-08-29 08:12:15 (3 days ago)	Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this add ... show more Blocked abusive HTTP application-layer DoS / botnet traffic from 3.221.156.96: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host. show less	DDoS Attack Bad Web Bot Exploited Host
🇩🇪 Hugopvigo	2026-08-28 21:54:14 (4 days ago)	"2026-08-28 21:54:14+00:00 3.221.156.96 IP con score alto (100) detectada en el log."	Brute-Force SSH
🇩🇪 MarkGGN	2026-08-28 11:23:10 (4 days ago)	Web attack. 3.221.156.96 - - [28/Aug/2026:13:23:09 +0200] "GET /wp-json/wp/v2/tags/1046 HTTP/1.1" 20 ... show more Web attack. 3.221.156.96 - - [28/Aug/2026:13:23:09 +0200] "GET /wp-json/wp/v2/tags/1046 HTTP/1.1" 200 318 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36" show less	Web App Attack

Showing 1 to 15 of 2429 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 210.245.20.230

🇮🇩 203.30.237.34

🇳🇱 193.47.62.69

🇳🇱 185.220.176.159

🇺🇸 136.117.167.131

🇪🇸 34.175.248.209

🇦🇺 34.40.145.110

🇳🇱 2a00:1450:4013:c20::12b

🇺🇸 2001:470:1:332::25

🇦🇷 201.182.3.2

🇺🇦 194.44.50.191

🇨🇱 190.215.236.215

🇪🇸 185.183.223.172

🇨🇳 183.236.7.194

🇦🇷 179.36.254.105

🇰🇪 102.0.33.90

🇰🇪 102.0.16.118

🇻🇳 101.99.37.80

🇭🇰 101.36.110.201

🇭🇺 91.83.65.1