JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.209.55.25

18.209.55.25 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 77%: ?

77%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-18-209-55-25.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.209.55.25

Whois 18.209.55.25

IP Abuse Reports for 18.209.55.25:

This IP address has been reported a total of 18 times from 13 distinct sources. 18.209.55.25 was first reported on July 24th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇾 lns.bz	2026-07-25 04:11:17 (4 hours ago)	Too many 404 requests [BY]	Web App Attack
🇫🇷 masterguru	2026-07-25 02:55:50 (6 hours ago)	Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
🇺🇸 wteiken	2026-07-25 02:54:26 (6 hours ago)	rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.git/config HTTP/ ... show more rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.git/config HTTP/1.1" 404 561 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.env HTTP/1.1" 404 561 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.env.local HTTP/1.1" 404 561 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.env.production HTTP/1.1" 404 561 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" rocinante.teiken.net:443 18.209.55.25:59838 - - [24/Jul/2026:22:54:26 -0400] "GET /.env.staging HTTP/1.1" 404 561 "-" "M ... show less	Web App Attack
Anonymous	2026-07-25 02:31:47 (6 hours ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-24 22:04:26 (11 hours ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇩🇪 big-cloud.nl	2026-07-24 13:53:48 (19 hours ago)	Try to access /.git/config	Web App Attack
🇮🇹 CoreTech srl	2026-07-24 12:48:56 (20 hours ago)	cloudlinux2 fail2ban: 2026-07-24 14:47:47,472 fail2ban.filter [1816]: INFO [plesk-wordpre ... show more cloudlinux2 fail2ban: 2026-07-24 14:47:47,472 fail2ban.filter [1816]: INFO [plesk-wordpress] Found 216.24.219.37 - 2026-07-24 14:47:46cloudlinux2 fail2ban: 2026-07-24 14:47:56,855 fail2ban.filter [1816]: INFO [plesk-modsecurity] Found 18.209.55.25 - 2026-07-24 14:47:56cloudlinux2 fail2ban: 2026-07-24 14:47:56,555 fail2ban.filter [1816]: INFO [plesk-modsecurity] Found 18.209.55.25 - 2026-07-24 14:47:56cloudlinux2 fail2ban: 2026-07-24 14:47:57,463 fail2ban.filter [1816]: INFO [plesk-modsecurity] Found 18.209.55.25 - 2026-07-24 14:47:57cloudlinux2 fail2ban: 2026-07-24 14:47:57,058 fail2ban.filter [1816]: INFO [plesk-modsecurity] Found 18.209.55.25 - 2026-07-24 14:47:57cloudlinux2 fail2ban: 2026-07-24 14:47:57,850 fail2ban.actions [1816]: NOTICE [plesk-modsecurity] Ban 18.209.55.25cloudlinux2 fail2ban: 2026-07-24 14:47:57,864 fail2ban.filter [1816]: INFO [plesk-modsecurity] Found 18.209.55.25 - 2026-07-24 14:47:57cloudlinux2 fail2ban: 2026- show less	Web App Attack
🇿🇦 conure	2026-07-24 11:44:28 (21 hours ago)	csagent: score 20.0: secrets grab x2; 1 domain(s) in 0s	Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 10:54:37 (22 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 06:54:32.917856 2026] [security2:error] [pid 564800:tid 564800] [client 18.209.55.25:52624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gotdt.com.tlambert.us"] [uri "/.git/config"] [unique_id "amNEaCkE7XZQp81j2gqhyAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-24 10:31:08 (22 hours ago)	[ns3.backorder.gr] httpd-config-scan: sites=www.example.com,debug-gosolar.gr,www.gosolar.gr; logs=/v ... show more [ns3.backorder.gr] httpd-config-scan: sites=www.example.com,debug-gosolar.gr,www.gosolar.gr; logs=/var/log/httpd/access_log,/var/log/httpd/domains/debug-gosolar.gr.log,/var/log/httpd/domains/gosolar.gr.log; samples=/.git/config \| /.env \| /.env.local show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 09:53:52 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:53:47.242663 2026] [security2:error] [pid 269020:tid 269056] [client 18.209.55.25:34486] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gorealtors.appraisalteam.net"] [uri "/.git/config"] [unique_id "amM2K6Q0ocjb3hrZgbTvtgAAAYQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 09:35:00 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:34:55.818452 2026] [security2:error] [pid 3551483:tid 3551483] [client 18.209.55.25:59492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.gopherblower.com.rotarymagnetics.com"] [uri "/.git/config"] [unique_id "amMxv8p306cvY2yGag4K4wAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 08:48:26 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 04:48:18.397964 2026] [security2:error] [pid 752456:tid 752475] [client 18.209.55.25:50494] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.goodwill-japan.kylight.com"] [uri "/.git/config"] [unique_id "amMm0lEPOvqW5JFY42Wq2AAAAFE"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-07-24 06:31:22 (1 day ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 06:07:25 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 18.209.55.25 (ec2-18-209-55-25.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:07:21.564969 2026] [security2:error] [pid 3394338:tid 3394338] [client 18.209.55.25:35642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.golflavahotsprings.com.bonefrog.com"] [uri "/.git/config"] [unique_id "amMBGdAHcbpH-Kjkb17rugAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 152.32.171.184

🇨🇳 125.77.73.145

🇮🇩 114.10.43.184

🇨🇦 85.217.149.71

🇸🇬 84.75.150.63

🇨🇳 223.167.168.192

🇳🇱 195.178.110.217

🇳🇱 172.94.9.37

🇺🇸 162.216.149.69

🇨🇳 123.120.53.24

🇭🇰 118.193.45.65

🇺🇸 109.105.210.74

🇧🇩 103.138.171.235

🇮🇩 103.90.67.3

🇸🇬 82.38.180.139

🇬🇧 81.19.219.234

🇪🇸 62.82.230.47

🇺🇸 35.196.42.3

🇩🇪 195.254.165.248

🇹🇷 195.174.132.129