18.205.28.120
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- Amazon Technologies Inc.
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS14618
- Hostname(s)
- ec2-18-205-28-120.compute-1.amazonaws.com
- Domain Name
- amazon.com
- Country
- 🇺🇸 United States of America
- City
- Ashburn, Virginia
Abuse Reports
Total reports
108 from
78 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇷🇴 Viperel |
RouterOS: Repeated connections to sensitive (SSH/RDP/TELNET/DB/MGM) ports detected.
|
Port Scan Brute-Force | |
| 🇫🇷 uthul |
T-Pot honeypot: 14 hits on ports [22] (automated)
|
Port Scan Brute-Force SSH | |
| 🇹🇷 Threat.live |
Threat.live: Web Scan
|
Web App Attack | |
| 🇳🇵 radheykrishna.com.np |
Nov 15 12:30:45 kernel: [3630385.810981] [UFW BLOCK] IN=ens160 OUT= SRC=18.205.28.120 LEN=60 TOS=0x00 PREC=0x00 TTL=120 ID=49867 DF PROTO=TCP SPT=52810 DPT=10443 WINDOW=62727 RES=0x00 SYN URGP=0
...
|
Port Scan | |
| 🇳🇱 Tsumugi Kotobuki |
Port Scan on Honeypot | Ports: 8080/HTTP-proxy | Proto: TCP(1) | Flags: all SYN | TTL: 110 | Len: 60B | Win: 62727(1) | rDNS: ec2-18-205-28-120.compute-1.amazonaws.com | F2B/ufw-honeypot@2026-11-15T02:48:36Z
|
Port Scan Hacking | |
| 🇫🇷 Kejult |
Honeypot Finding: active TCP application payload captured by Honeytrap; 3 payload-bearing connection/event(s), 729 payload byte(s) total, maximum payload 243 byte(s). Target port(s): 3232.
|
Port Scan Hacking | |
| 🇨🇳 yiyan |
Web probe targeting 'GET /'. Log: 18.205.28.120 - - [14/Nov/2026:20:02:50 +0800] "GET / HTTP/1.1" 200 733 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safar
|
Hacking Bad Web Bot | |
| 🇫🇷 uthul |
T-Pot honeypot: 10 hits on ports [443] (automated)
|
Port Scan Web App Attack | |
| 🇺🇸 donarev419 |
Connection to port 443 with data transfer.
Data preview:
|
Port Scan Hacking | |
| 🇫🇷 uthul |
T-Pot honeypot: 7 hits on ports [8443, 10443] (automated)
|
Port Scan Web App Attack | |
| 🇫🇷 uthul |
T-Pot honeypot: 6 hits on ports [10443] (automated)
|
Port Scan | |
| 🇺🇸 cwytech |
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/pf-geofence-high.
|
Hacking | |
| 🇫🇷 uthul |
T-Pot honeypot: 10 hits on ports [8443] (automated)
|
Port Scan Web App Attack | |
| 🇺🇸 sumnone |
Port probing on unauthorized port 3000
|
Port Scan Hacking Exploited Host | |
| 🇩🇪 iNetWorker |
firewall-block, port(s): 8443/tcp
|
Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown