JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.188.191.244

18.188.191.244 was found in our database!

This IP was reported 147 times. Confidence of Abuse is 0%: ?

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-188-191-244.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.188.191.244

Whois 18.188.191.244

IP Abuse Reports for 18.188.191.244:

This IP address has been reported a total of 147 times from 108 distinct sources. 18.188.191.244 was first reported on January 9th 2026, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2026-04-22 00:05:00 (4 months ago)	ThreatBook Intelligence: Edu,Zombie more details on https://threatbook.io/ip/18.188.191.244 2026-04- ... show more ThreatBook Intelligence: Edu,Zombie more details on https://threatbook.io/ip/18.188.191.244 2026-04-21 16:38:20 /robots.txt 2026-04-21 16:38:21 /cc.gif show less	Web App Attack
🇹🇷 rtbh.com.tr	2026-01-26 16:11:13 (7 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇬🇧 [email protected]	2026-01-25 00:45:54 (7 months ago)	...	Brute-Force SSH
🇳🇱 homeshowdomain.nl	2026-01-17 22:59:02 (7 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-01-16. show less	Hacking Web App Attack SSH
🇬🇧 openstrike.co.uk	2026-01-17 06:12:49 (7 months ago)	8 attacks on env grabbing URLs, PHP URLs, config grabbing URLs (type 2): GET /.env.save HTTP/1.1 GET ... show more 8 attacks on env grabbing URLs, PHP URLs, config grabbing URLs (type 2): GET /.env.save HTTP/1.1 GET /php_info.php HTTP/1.1 GET /config.json HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-01-17 04:31:16 (7 months ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇫🇷 SpaceHost-Server	2026-01-16 23:39:18 (7 months ago)		Brute-Force Web App Attack
🇳🇱 homeshowdomain.nl	2026-01-16 23:00:30 (7 months ago)	Auto-ban: >3000 req/min op 2026-01-16	Hacking Web App Attack SSH
🇺🇸 kuj	2026-01-16 17:39:19 (7 months ago)	2026-01-16T10:39:05.783154-07:00 derpamp-oci derper[31731]: 2026/01/16 10:39:05 http: TLS handshake ... show more 2026-01-16T10:39:05.783154-07:00 derpamp-oci derper[31731]: 2026/01/16 10:39:05 http: TLS handshake error from 18.188.191.244:53446: acme/autocert: missing server name 2026-01-16T10:39:18.442888-07:00 derpamp-oci derper[31731]: 2026/01/16 10:39:18 http: TLS handshake error from 18.188.191.244:58270: acme/autocert: missing server name 2026-01-16T10:39:18.449268-07:00 derpamp-oci derper[31731]: 2026/01/16 10:39:18 http: TLS handshake error from 18.188.191.244:58278: acme/autocert: missing server name ... show less	Port Scan Brute-Force
🇩🇪 kranem	2026-01-16 17:32:29 (7 months ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 16509 (AMAZON-02) Protocol: HTTP/1.1 (GET ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 16509 (AMAZON-02) Protocol: HTTP/1.1 (GET method) Endpoint: /.env.save Timestamp: 2026-01-16T06:30:21Z User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36 show less	Bad Web Bot
🇳🇴 Bots.go.to.hell	2026-01-16 17:12:51 (7 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/appsec-vpatch	Hacking Exploited Host
🇨🇭 GAS	2026-01-16 17:11:50 (7 months ago)	Direct IP access. 18.188.191.244 - - [16/Jan/2026:18:11:32 +0100] "GET / HTTP/1.1" 402 4822 "-" "Moz ... show more Direct IP access. 18.188.191.244 - - [16/Jan/2026:18:11:32 +0100] "GET / HTTP/1.1" 402 4822 "-" "Mozilla/5.0 (Linux; Android 8.1.0; vivo 1807) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36" "REDACTED" "" 18.188.191.244 - - [16/Jan/2026:18:11:49 +0100] "GET /.env.save HTTP/1.1" 402 4828 "-" "Mozilla/5.0 (Linux; Android 9; ONEPLUS A6013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36" "REDACTED" "" ... show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-01-16 17:08:26 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 18.188.191.244 (ec2-18-188-191-244.us-east-2.co ... show more (mod_security) mod_security (id:210492) triggered by 18.188.191.244 (ec2-18-188-191-244.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 12:08:20.444215 2026] [security2:error] [pid 22964:tid 22964] [client 18.188.191.244:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nyemdr-online.com"] [uri "/.env.save"] [unique_id "aWpwhDNWcJDI72wUKgkvjgAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 David Ferneding	2026-01-16 17:05:58 (7 months ago)	This IP was blocked by CrowdSec, triggering crowdsecurity/http-sensitive-files	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-01-16 16:48:08 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 18.188.191.244 (ec2-18-188-191-244.us-east-2.co ... show more (mod_security) mod_security (id:210492) triggered by 18.188.191.244 (ec2-18-188-191-244.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 11:48:03.648200 2026] [security2:error] [pid 4951:tid 4951] [client 18.188.191.244:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.sistememail.com"] [uri "/api/.env"] [unique_id "aWprwwHQtkT65xYgBApasQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 147 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 59.22.68.213

🇸🇬 198.46.163.243

🇬🇧 195.206.182.220

🇦🇷 190.136.13.4

🇳🇱 188.91.1.157

🇮🇷 185.60.136.87

🇮🇩 116.0.3.244

🇿🇦 105.233.136.216

🇸🇬 101.47.8.188

🇪🇪 95.85.245.227

🇫🇷 85.217.140.27

🇸🇦 82.167.164.204

🇹🇷 81.214.10.175

🇹🇼 49.214.255.28

🇳🇱 45.148.10.157

🇦🇺 16.26.142.204

🇹🇿 196.41.46.194

🇺🇸 195.184.76.67

🇳🇱 195.178.110.228

🇺🇸 173.53.60.58