JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

18.196.32.99

Neutral Activity

Abuse Confidence Score

0% Low Risk

30 reports

25 reporters · latest 3 months ago

ISP: A100 ROW GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-18-196-32-99.eu-central-1.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

18.196.32.99 has been reported 30 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

30 from 25 distinct reporters

First reported

April 3rd 2022

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 UTC · (3 months ago)	Apache probe; attempts=623; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.old \| /.e ... show more Apache probe; attempts=623; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.remote \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| /bin/.env \| /bootstrap/.env \| /brevo/.env \| /build/.env \| /buildkite/.env \| /bulk/.env \| /cache/.en \| ... [204 exact paths total] show less	Web App Attack
🇺🇸 MatCat	2026-07-27 21:05:03 UTC · (3 months ago)	Banned by fail2ban: apache-webprobe	Port Scan Bad Web Bot
Anonymous	2026-07-27 20:44:27 UTC · (3 months ago)	Trying to access config files	Web App Attack
🇩🇪 grassau.com	2026-07-27 20:43:28 UTC · (3 months ago)	(mod_security) mod_security triggered on hostname [redacted] 18.196.32.99 (DE/Germany/Hesse/Frankfurt am Main/ec2-18-196-32-99.eu-central-1.compute.amazonaws.com)	SQL Injection
🇩🇪 Kreapptivo	2026-07-27 18:08:40 UTC · (3 months ago)	[27/Jul/2026:20:08:39 +0200] Web-Request: "GET /.git/config", User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"	Bad Web Bot Web App Attack
Anonymous	2026-07-27 15:31:14 UTC · (3 months ago)	[ns1.skdns.gr] httpd-suspicious-path: iis-w3c	Hacking Web App Attack
🇸🇪 vaia.cloud	2026-07-27 14:30:02 UTC · (3 months ago)	crowdsecurity/http-crawl-non_statics	Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-27 12:36:40 UTC · (3 months ago)	Excessive multi-domain requests	Brute-Force
Anonymous	2026-07-27 10:07:49 UTC · (3 months ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇫🇷 masterguru	2026-07-27 08:28:24 UTC · (3 months ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇩🇪 DocNetzwerk	2026-07-27 04:25:39 UTC · (3 months ago)	(mod_security) mod_security triggered on hostname [redacted] 18.196.32.99 (DE/Germany/ec2-18-196-32-99.eu-central-1.compute.amazonaws.com)	SQL Injection
🇺🇸 TPI-Abuse	2026-07-26 09:52:43 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 18.196.32.99 (ec2-18-196-32-99.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 05:52:37.185729 2026] [security2:error] [pi ... show more (mod_security) mod_security (id:210492) triggered by 18.196.32.99 (ec2-18-196-32-99.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 05:52:37.185729 2026] [security2:error] [pid 391784:tid 391810] [client 18.196.32.99:53892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.totalbodycare753.kylight.com"] [uri "/.git/config"] [unique_id "amXY5eLVvuS0hwIp3cfRjwAAARE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 etu brutus	2026-07-26 07:12:05 UTC · (3 months ago)	18.196.32.99 has been banned for [WebApp Attack] ...	Hacking Bad Web Bot Web App Attack
🇩🇪 yitzhaq	2026-07-26 07:01:19 UTC · (3 months ago)	18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /php.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /i.php HTTP/1 ... show more 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /php.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /i.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /pi.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /pinfo.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /test.php HTTP/1.1" 404 633 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.196.32.99 - - [26/Jul/2026:09:01:17 +0200] "GET /phpinfo HTTP/1.1" show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-07-26 04:59:13 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 18.196.32.99 (ec2-18-196-32-99.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 00:59:07.613844 2026] [security2:error] [pi ... show more (mod_security) mod_security (id:210492) triggered by 18.196.32.99 (ec2-18-196-32-99.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 00:59:07.613844 2026] [security2:error] [pid 2210591:tid 2210591] [client 18.196.32.99:46894] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.topografiazgs.com.disenowebprofesional.com"] [uri "/.git/config"] [unique_id "amWUG5XEzca11tJrx7VqYgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:5:5fca:a001

🇺🇸 172.81.135.182

🇫🇮 147.185.133.123

🇮🇳 103.173.204.201

🇳🇱 77.239.124.80

🇹🇹 186.96.209.74

🇨🇳 101.126.43.201

🇺🇸 100.1.6.29

🇺🇸 40.77.167.47

🇸🇬 8.222.171.89

🇨🇳 8.134.199.208

🇲🇽 189.130.59.233

🇲🇽 187.140.59.174

🇺🇸 172.191.94.172

🇬🇧 159.65.19.22

🇩🇪 95.90.13.168

🇨🇳 58.58.42.246

🇭🇰 49.213.6.30

🇬🇧 188.240.59.41

🇩🇪 167.94.146.43