AbuseIPDB » 18.116.239.38

18.116.239.38 was found in our database!

This IP was reported 331 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-116-239-38.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 18.116.239.38

Whois 18.116.239.38

IP Abuse Reports for 18.116.239.38:

This IP address has been reported a total of 331 times from 136 distinct sources. 18.116.239.38 was first reported on November 11th 2024, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rjdefrancisco	2025-07-16 07:07:26 (8 hours ago)	Unwanted traffic detected by honeypot on July 15, 2025: port scans (1 port 23 scan and 1 port 22 sca ... show moreUnwanted traffic detected by honeypot on July 15, 2025: port scans (1 port 23 scan and 1 port 22 scan). show less	Port Scan Brute-Force SSH
Anonymous	2025-07-15 22:30:06 (17 hours ago)	Triggered: repeated knocking on closed ports.	Port Scan
Anonymous	2025-07-14 19:06:04 (1 day ago)	Fail2Ban detectó intento de acceso no autorizado en puerto 8080 a través de TLS HandShake	Port Scan
Study Bitcoin 🤗	2025-07-14 06:16:41 (2 days ago)	129 port probes: tcp/7002 (weblogic), tcp/995 (pop3over tls), tcp/587 (message submission (sendmail) ... show more129 port probes: tcp/7002 (weblogic), tcp/995 (pop3over tls), tcp/587 (message submission (sendmail)), tcp/9100 (hp jetdirect), tcp/53 (domain name), tcp/5986, tcp/1090 (ff fieldbus message specification), tcp/27018, tcp/47001, tcp/11111 (viral computing environment (vce)), tcp/8080 (http), tcp/3479, tcp/2222 (rockwell csp2), tcp/5985, tcp/106 (3com-tsmux), tcp/7777 (oracle app), tcp/4505, tcp/7071, tcp/2888 (spcsdlobby), tcp/635 (rlz dbase), tcp/9200 (wap connectionless session service), tcp/8111, tcp/7001 (weblogic), tcp/1723 (pptp), tcp/3050 (gds_db), tcp/81 (hosts2 name), tcp/4190, tcp/30443, tcp/102 (msexchangemta x.400), tcp/8649, tcp/7990, tcp/9001 (cisco-xremote), tcp/5556 (mtbd (mtb backup)), tcp/137 (netbios), tcp/111 (sun remote procedure call), tcp/79 (finger), tcp/5432 (postgres database), tcp/113 (authentication service), tcp/8040, tcp/47002, tcp/32400, tcp/1812 (radius), tcp/5984, tcp/1144 [srv125] show less	DNS Compromise DDoS Attack FTP Brute-Force Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Web App Attack SSH IoT Targeted
Study Bitcoin 🤗	2025-07-13 08:44:38 (3 days ago)	269 port probes: 3x tcp/9000 (cslistener), 3x tcp/503 (intrinsa), 3x tcp/4443 (pharos), 3x tcp/7777 ... show more269 port probes: 3x tcp/9000 (cslistener), 3x tcp/503 (intrinsa), 3x tcp/4443 (pharos), 3x tcp/7777 (oracle app), 3x tcp/111 (sun remote procedure call), 3x tcp/8278, 3x tcp/9200 (wap connectionless session service), 3x tcp/3389 (rdp), 3x tcp/35 (any private printer), 3x tcp/143 (internet message access), 3x tcp/81 (hosts2 name), 3x tcp/138 (netbios), 3x tcp/8686, 3x tcp/4786, 3x tcp/80 (http), 3x tcp/9301, 3x tcp/10443, 3x tcp/1521 (oracle8i listener), 3x tcp/3306 (mysql), 3x tcp/9300, 3x tcp/443 (https), 3x tcp/27017, 3x tcp/9091, 3x tcp/8291, 3x tcp/9092, 3x tcp/30443, 3x tcp/7003 (volume location database), 3x tcp/110 (post office- version 3), 3x tcp/9100 (hp jetdirect), 3x tcp/21 (ftp control), 3x tcp/8002 (http), 3x tcp/2379, 3x tcp/23 (telnet), 3x tcp/139 (netbios), 3x tcp/3050 (gds_db), 3x tcp/7004 (afs), 3x tcp/22 (ssh), 3x tcp/9002, 3x tcp/5902, 3x tcp/12443, 3x tcp/9503, 3x tcp/82 (xfer utilit [srv131,srv133,srv132] show less	DNS Compromise DDoS Attack FTP Brute-Force Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Web App Attack SSH IoT Targeted
Anonymous	2025-07-13 01:12:45 (3 days ago)	...	Web App Attack
SimonB	2025-07-13 00:44:07 (3 days ago)	SSH bruteforce attempt	Brute-Force SSH
security.rdmc.fr	2025-07-12 07:46:54 (4 days ago)	IP in Malicious Database	Web App Attack
sauron-le-noir	2025-07-11 16:52:31 (4 days ago)	scan port : 23 from États Unis at Fri Jul 11 18:49:19 2025	Port Scan
Papy Abuse	2025-07-10 21:21:10 (5 days ago)	scanlogd	Port Scan
mueller-nils.com	2025-07-10 20:34:06 (5 days ago)	Jul 10 22:34:06 [host] kernel: [10877706.311840] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=18.116.239.38 D ... show moreJul 10 22:34:06 [host] kernel: [10877706.311840] [UFW BLOCK] IN=venet0 OUT= MAC= SRC=18.116.239.38 DST=[munged] LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=40259 DF PROTO=TCP SPT=53386 DPT=82 WINDOW=62727 RES=0x00 SYN URGP=0 Jul 10 22:34:06 [host] kernel: [1 show less	Port Scan
HoneyPotEu-AT	2025-07-10 18:51:44 (5 days ago)	1752173503 - 07/10/2025 20:51:43 Host: 18.116.239.38/18.116.239.38 Port: 79 TCP Blocked ...	Port Scan
webbfabriken	2025-07-10 08:48:40 (6 days ago)	spam or other hacking activities reported by webbfabriken security servers Attack reported by ... show morespam or other hacking activities reported by webbfabriken security servers Attack reported by Webbfabriken Security API - WFSecAPI show less	Web Spam
sauron-le-noir	2025-07-10 05:26:09 (6 days ago)	scan port : 23 from États Unis at Thu Jul 10 07:22:59 2025	Port Scan
adnscom.net	2025-07-09 08:57:28 (1 week ago)	IPS trigger: Brute force SSH scanning/attack	Brute-Force SSH

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩