JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

18.193.89.239

Activity Trending Down

Abuse Confidence Score

45% Elevated

8 reports

8 reporters · latest 1 week ago

ISP: A100 ROW GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-18-193-89-239.eu-central-1.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

8 from 8 distinct reporters

First reported

November 2nd 2026

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇩🇪 Germany 2 🇧🇷 Brazil 1 🇨🇭 Switzerland 1

Most common categories Web App Attack 8 Hacking 2 Brute-Force 2 Bad Web Bot 1 SSH 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-11-03 23:00:45 UTC · (1 week ago)	Auto-ban: >3000 req/min op 2026-11-03	Web App Attack SSH Hacking
🇨🇭 zynex	2026-11-03 14:35:33 UTC · (1 week ago)	URL Probing: /server/.env	Web App Attack
🇫🇷 masterguru	2026-11-02 06:57:53 UTC · (1 week ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)	Hacking Web App Attack
🇺🇸 iwle	2026-11-02 04:50:49 UTC · (1 week ago)	[Sun Nov 01 23:50:47.161980 2026] [:error] [pid 310496:tid 310576] [client 18.193.89.239:0] [client 18.193.89.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^\|/)(?:\\\\.env(?:\\\\.[^/])?\|\\\\.git(?:/\|$)\|phpinfo(?:\\\\ ... show more [Sun Nov 01 23:50:47.161980 2026] [:error] [pid 310496:tid 310576] [client 18.193.89.239:0] [client 18.193.89.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^\|/)(?:\\\\.env(?:\\\\.[^/])?\|\\\\.git(?:/\|$)\|phpinfo(?:\\\\.php)?(?:\\\\.(?:bak\|old\|save\|tmp\|swp\|~))?\|php-info\\\\.php\|phpversion\\\\.php\|info\\\\.php\|debug\\\\.php\|pinfo\\\\.php\|pi\\\\.php\|php\\\\.php\|i\\\\.php\|application_default_credentials\\\\.json\|(?:firebase\|google ..." at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/local_rules/100-site-policy.conf"] [line "146"] [id "100113"] [msg "Local Policy: Sensitive file or diagnostic endpoint probe"] [severity "WARNING"] [tag "local/sensitive-file-probe"] [hostname "webmail.ufscards.com"] [uri "/.env"] [unique_id "augWp17FWZIQ9ycHOY40qgAAAEA"] [Sun Nov 01 23:50:47.638937 2026] [:error] [pid 310496:tid 310629] [client 18.193.89.239:0] [client 18.193.89.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "(?i)(?:^\|/)(?:\\\\.env( ... show less	Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-11-02 03:20:20 UTC · (1 week ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 throny	2026-11-02 03:12:38 UTC · (1 week ago)	Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 6 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0 ... show more Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...). Requests within an hour: 6 on 1 host(s) User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Sa Requested, e.g.: - webmail.[REDACTED]/ - webmail.[REDACTED]/info.php - webmail.[REDACTED]/php.php - webmail.[REDACTED]/phpinfo.php show less	Web App Attack
🇮🇹 VHosting	2026-11-02 02:10:03 UTC · (1 week ago)	Detected WordPress attack from different servers	Brute-Force Web App Attack
Anonymous	2026-11-02 01:54:04 UTC · (1 week ago)	Multiple web server 400 error codes from same source ip	Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇭🇰 46.247.61.193

🇩🇪 194.187.176.74

🇦🇷 181.177.197.68

🇺🇸 157.22.44.154

🇰🇷 112.167.230.128

🇮🇩 103.158.121.21

🇯🇵 103.7.236.163

🇦🇹 62.83.33.214

🇺🇸 54.147.182.90

🇺🇸 45.79.190.10

🇺🇸 45.33.109.18

🇲🇾 14.192.214.239

🇭🇰 165.154.73.93

🇸🇬 145.223.150.27

🇮🇳 122.15.129.26

🇪🇸 81.35.162.191

🇬🇧 81.19.219.197

🇷🇴 2.57.121.112

🇨🇴 190.84.117.103

🇲🇽 177.242.197.155