JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.197.42.170

18.197.42.170 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 65%: ?

65%

ISP	A100 ROW GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-197-42-170.eu-central-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.197.42.170

Whois 18.197.42.170

IP Abuse Reports for 18.197.42.170:

This IP address has been reported a total of 14 times from 13 distinct sources. 18.197.42.170 was first reported on April 29th 2022, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 bigscoots.com	2026-07-26 07:47:12 (21 hours ago)	(PERMBLOCK) 18.197.42.170 (DE/Germany/ec2-18-197-42-170.eu-central-1.compute.amazonaws.com) has had ... show more (PERMBLOCK) 18.197.42.170 (DE/Germany/ec2-18-197-42-170.eu-central-1.compute.amazonaws.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Brute-Force SSH
🇫🇷 Octopuce	2026-07-26 07:32:23 (21 hours ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇫🇷 Zundapper	2026-07-26 07:24:07 (22 hours ago)	18.197.42.170 - - [26/Jul/2026:09:24:04 +0200] "GET /config/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 ... show more 18.197.42.170 - - [26/Jul/2026:09:24:04 +0200] "GET /config/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.197.42.170 - - [26/Jul/2026:09:24:05 +0200] "GET /vendor/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.197.42.170 - - [26/Jul/2026:09:24:06 +0200] "GET /bin/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.197.42.170 - - [26/Jul/2026:09:24:06 +0200] "GET /temp/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.197.42.170 - - [26/Jul/2026:09:24:07 +0200] "GET /logs/.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack Port Scan
Anonymous	2026-07-26 07:10:14 (22 hours ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇺🇸 TPI-Abuse	2026-07-26 06:01:09 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.197.42.170 (ec2-18-197-42-170.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 18.197.42.170 (ec2-18-197-42-170.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 02:01:05.914817 2026] [security2:error] [pid 2093276:tid 2093276] [client 18.197.42.170:44786] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.meridianranchdrc.org"] [uri "/.git/config"] [unique_id "amWiocjK8sfQ0TqR03syLQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Melle	2026-07-26 05:26:47 (1 day ago)	Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 18.197.42.170 triggered 5 event ... show more Blocked by CrowdSec \| Scenario: crowdsecurity/http-sensitive-files \| 18.197.42.170 triggered 5 events \| Detected: 2026-07-26T05:26:46.56963225Z show less	Web App Attack Hacking
🇺🇸 MatCat	2026-07-26 04:05:04 (1 day ago)	Banned by fail2ban: apache-webprobe	Port Scan Bad Web Bot
Anonymous	2026-07-26 02:42:06 (1 day ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
🇫🇮 as211431.net	2026-07-24 06:55:54 (2 days ago)	Triggered Cloudflare WAF (linkMaze) from DE. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GE ... show more Triggered Cloudflare WAF (linkMaze) from DE. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GET method) Endpoint: /firebase-key.json UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 dynamix	2026-07-24 05:54:25 (2 days ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-07-24 04:35:12 (3 days ago)	Failed login attempt detected by Fail2Ban in plesk-modsecurity jail	Exploited Host
🇺🇸 TPI-Abuse	2026-07-24 04:24:31 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 18.197.42.170 (ec2-18-197-42-170.eu-central-1.c ... show more (mod_security) mod_security (id:210492) triggered by 18.197.42.170 (ec2-18-197-42-170.eu-central-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 00:24:27.269826 2026] [security2:error] [pid 3026588:tid 3026588] [client 18.197.42.170:54348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mazzaro.com.tr"] [uri "/.git/config"] [unique_id "amLo-7iJeRSXlZr3jqnZQgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-24 04:19:27 (3 days ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇨🇭 backslash	2022-04-29 09:50:15 (4 years ago)	block ruleset bad bot: ignores robots.txt 8010B44F7E78AD8B94C70711C72D11CDE0DAC0F4	Bad Web Bot

Showing 1 to 14 of 14 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 40.83.182.122

🇹🇼 198.235.24.120

🇩🇪 193.124.20.236

🇷🇺 193.24.123.15

🇲🇴 182.93.7.194

🇮🇳 106.222.248.190

🇺🇸 85.239.151.10

🇸🇬 84.75.155.225

🇵🇱 51.83.130.98

🇬🇧 45.82.76.116

🇮🇩 36.68.52.72

🇬🇧 35.203.211.34

🇵🇰 175.107.222.148

🇺🇸 167.253.19.181

🇧🇯 137.255.13.181

🇯🇵 103.163.220.200

🇳🇱 45.148.10.239

🇮🇳 20.40.44.6

🇷🇺 178.129.175.157

🇮🇩 163.7.9.55