JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.185.172.95

18.185.172.95 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 83%: ?

83%

ISP	A100 ROW GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-185-172-95.eu-central-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.185.172.95

Whois 18.185.172.95

IP Abuse Reports for 18.185.172.95:

This IP address has been reported a total of 18 times from 14 distinct sources. 18.185.172.95 was first reported on July 25th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-07-27 22:00:48 (9 hours ago)	Auto-ban: >3000 req/min op 2026-07-27	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-07-27 16:12:51 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 12:12:43.344179 2026] [security2:error] [pid 160799:tid 160801] [client 18.185.172.95:48082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prominentregroup.com"] [uri "/.git/config"] [unique_id "ameDe42bw1heHdtGK9RR7gAAAUA"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 djboddington	2026-07-27 15:10:38 (16 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇪🇸 yvoictra	2026-07-27 14:44:04 (16 hours ago)	18.185.172.95 - - [27/Jul/2026:16:44:03 +0200] "GET /.git/config HTTP/1.1" 404 19 "-" "Mozilla/5.0 ( ... show more 18.185.172.95 - - [27/Jul/2026:16:44:03 +0200] "GET /.git/config HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.185.172.95 - - [27/Jul/2026:16:44:03 +0200] "GET /.env HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.185.172.95 - - [27/Jul/2026:16:44:03 +0200] "GET /.env.local HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.185.172.95 - - [27/Jul/2026:16:44:03 +0200] "GET /.env.production HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.185.172.95 - - [27/Jul/2026:16:44:04 +0200] "GET /.env.staging HTTP/1.1" 404 19 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 12:30:48 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 08:30:41.618022 2026] [security2:error] [pid 2025306:tid 2025357] [client 18.185.172.95:38542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "promc.xyz"] [uri "/.git/config"] [unique_id "amdPcUQ81MuyuQcI1rBDBgAAAZQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇿 Antinson	2026-07-27 12:12:23 (19 hours ago)	Scraping with a high error ratio and request rate	Bad Web Bot
🇧🇷 maviei	2026-07-27 09:22:02 (22 hours ago)	CrowdSec local detection on srv1349699: http-probing. Blocked. AS16509 (DE), 11 events.	Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-07-27 06:52:17 (1 day ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇸🇪 vaia.cloud	2026-07-27 06:25:02 (1 day ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇩🇪 Ba-Yu	2026-07-27 06:21:35 (1 day ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
Anonymous	2026-07-27 06:05:35 (1 day ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
🇺🇸 TPI-Abuse	2026-07-27 05:03:25 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 18.185.172.95 (ec2-18-185-172-95.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 01:03:20.533640 2026] [security2:error] [pid 399654:tid 399654] [client 18.185.172.95:46546] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "projectthinkspot.com"] [uri "/.git/config"] [unique_id "ambmmM3ZtpBuMpCZfSrifQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-07-27 04:29:07 (1 day ago)	(modsecurity) srv102 ModSecurity 18.185.172.95 (DE/Germany/ec2-18-185-172-95.eu-central-1.compute.am ... show more (modsecurity) srv102 ModSecurity 18.185.172.95 (DE/Germany/ec2-18-185-172-95.eu-central-1.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
Anonymous	2026-07-26 07:13:17 (2 days ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇸🇪 vaia.cloud	2026-07-25 03:50:02 (3 days ago)	crowdsecurity/http-crawl-non_statics	Brute-Force Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇺 197.227.8.186

🇧🇷 189.46.3.185

🇫🇷 152.228.200.53

🇺🇸 109.105.210.105

🇳🇱 45.148.10.151

🇱🇺 2a00:5980:94::87

🇦🇴 193.163.125.126

🇸🇬 172.104.55.33

🇫🇮 147.185.133.238

🇻🇳 118.70.192.243

🇩🇪 104.207.51.95

🇻🇳 103.20.97.75

🇺🇸 98.127.132.178

🇺🇸 64.62.156.203

🇬🇧 45.3.42.180

🇬🇧 45.3.42.14

🇮🇳 43.227.22.134

🇺🇸 20.64.106.41

🇺🇸 2001:470:1:c84::1cb

🇰🇷 211.211.208.113