JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

15.237.83.238

Neutral Activity

Abuse confidence score ?

0% Low Risk

117 reports

56 reporters · latest 1 year ago

ISP	Amazon Data Services France
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-15-237-83-238.eu-west-3.compute.amazonaws.com
Domain Name	amazon.com
Country	🇫🇷 France
City	Paris, Ile-de-France

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

15.237.83.238 has been reported 117 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 15.237.83.238

This IP address has been reported a total of 117 times from 56 distinct sources. 15.237.83.238 was first reported on March 3rd 2025, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2025-03-09 23:03:07 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇩🇪 LRob	2025-03-07 23:12:07 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇫🇷 service Informatique	2025-03-06 04:00:37 (1 year ago)	GET /sftp-config.json	Web App Attack
🇬🇧 SecondEdge	2025-03-05 23:32:31 (1 year ago)	A web attack was detected from 15.237.83.238 (France / Paris / Paris) against dummy.second-edge.com ... show more A web attack was detected from 15.237.83.238 (France / Paris / Paris) against dummy.second-edge.com (SFTP Credential Exposure). show less	Web App Attack
🇩🇪 LRob	2025-03-05 23:21:38 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇩🇪 LRob	2025-03-05 23:21:38 (1 year ago)	Repeated attacks detected by Fail2Ban in recidive jail	Hacking
🇺🇸 Starburst SysOp Team	2025-03-05 23:20:00 (1 year ago)	[Wed Mar 05 23:20:04.390625 2025] [security2:error] [pid 2527125:tid 2527139] [client 15.237.83.238: ... show more [Wed Mar 05 23:20:04.390625 2025] [security2:error] [pid 2527125:tid 2527139] [client 15.237.83.238:61913] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-owasp-latest/coreruleset-4.11.0/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "143"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /sftp-config.json found within REQUEST_FILENAME: /sftp-config.json"] [severity "CRITICAL"] [ver "OWASP_CRS/4.11.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "iad5-2.starburstserver.net"] [uri "/sftp-config.json"] [unique_id "Z8jcJJC_sUXE65viMSOKuQAAAMw"] show less	Hacking Brute-Force Web App Attack
🇩🇪 Mr-Money	2025-03-05 23:14:26 (1 year ago)	15.237.83.238 - - [06/Mar/2025:00:14:25 +0100] "GET /.vscode/sftp.json HTTP/1.1" 404 498 "-" "Mozill ... show more 15.237.83.238 - - [06/Mar/2025:00:14:25 +0100] "GET /.vscode/sftp.json HTTP/1.1" 404 498 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
🇩🇪 Mr-Money	2025-03-05 21:45:14 (1 year ago)	05/Mar/2025:19:52:10 +010015.237.83.238 - - [05/Mar/2025:22:45:14 +0100] "GET /.vscode/sftp.json HTT ... show more 05/Mar/2025:19:52:10 +010015.237.83.238 - - [05/Mar/2025:22:45:14 +0100] "GET /.vscode/sftp.json HTTP/1.1" 404 505 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
🇯🇵 VXG-NET	2025-03-05 21:44:21 (1 year ago)	port=80, indicator_type=info-leak	Hacking
🇫🇷 Guardian	2025-03-05 21:24:42 (1 year ago)	Attempt to get system configuration (sftp-config.json) 15.237.83.238 [05/Mar/2025:21:24:41] "GET /sf ... show more Attempt to get system configuration (sftp-config.json) 15.237.83.238 [05/Mar/2025:21:24:41] "GET /sftp-config.json HTTP/1.1" show less	Port Scan Web App Attack
🇭🇰 smallbottle	2025-03-05 20:37:37 (1 year ago)	The IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 16509 clientASN ... show more The IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 16509 clientASNDescription: AMAZON-02 clientCountryName: FR clientIP: 15.237.83.238 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPath: /sftp-config.json clientRequestQuery: datetime: 2025-03-05T20:35:15Z rayName: 91bc6616b83622ac ruleId: 4989f24696b94676961cd00c29a049bb userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0. Report generated by Cloudflare-WAF-to-AbuseIPDB.(https://github.com/0123-smallbottle/Cloudflare-WAF-to-AbuseIPDB) About:(https://blog.smallbottle2.top/about) show less	Web Spam Bad Web Bot
🇩🇪 iNetWorker	2025-03-05 20:35:42 (1 year ago)	trolling for resource vulnerabilities	Web App Attack
🇫🇮 oh.mg	2025-03-05 19:59:17 (1 year ago)	[Wed Mar 05 20:59:15.710198 2025] [security2:error] [pid 2533310:tid 2533335] [client 15.237.83.238: ... show more [Wed Mar 05 20:59:15.710198 2025] [security2:error] [pid 2533310:tid 2533335] [client 15.237.83.238:59617] [client 15.237.83.238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "darksatellite.com"] [uri "/sftp-config.json"] [unique_id "Z8itE4yGgpzHPwIj8NAXNgAAAJc"] [Wed Mar 05 20:59:16.808400 2025] [security2:error] [pid 2533339:tid 2533389] [client 15.237.83.238:60639] [client 15.237.83.238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.1 ... show less	Bad Web Bot Web App Attack
🇺🇸 gerensat	2025-03-05 18:02:17 (1 year ago)	2025-03-05 15:02:17 \| /sftp-config.json \| [] \| Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0 ... show more 2025-03-05 15:02:17 \| /sftp-config.json \| [] \| Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 show less	Web App Attack

Showing 1 to 15 of 117 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.239.213.5

🇩🇪 165.227.130.153

🇨🇳 39.88.162.17

🇺🇸 18.218.118.203

🇺🇸 167.172.217.81

🇨🇦 147.182.154.58

🇺🇸 103.203.57.2

🇷🇴 92.118.39.71

🇨🇳 101.96.230.94

🇺🇸 70.175.180.222

🇫🇷 51.210.10.40

🇺🇸 34.148.7.7

🇧🇪 207.175.79.31

🇦🇷 200.59.88.52

🇳🇱 195.178.110.227

🇷🇴 193.46.255.86

🇲🇽 187.154.98.53

🇩🇪 167.94.145.29

🇫🇮 80.66.83.83

🇨🇳 60.12.5.190