JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.217.98.239

18.217.98.239 was found in our database!

This IP was reported 40 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-217-98-239.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.217.98.239

Whois 18.217.98.239

IP Abuse Reports for 18.217.98.239:

This IP address has been reported a total of 40 times from 36 distinct sources. 18.217.98.239 was first reported on July 24th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 cmbplf	2026-07-29 14:04:10 (1 day ago)	2.057 requests from abuseipdb.com blacklisted IP (1mo14h48m)	Brute-Force Bad Web Bot
Anonymous	2026-07-29 07:00:00 (2 days ago)	Apache probe; attempts=83; exact paths: /.env \| /.env.backup \| /.env.backup/ \| /.env.bak \| /.env.bak ... show more Apache probe; attempts=83; exact paths: /.env \| /.env.backup \| /.env.backup/ \| /.env.bak \| /.env.bak/ \| /.env.dev \| /.env.development \| /.env.development.local \| /.env.development/ \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.local/ \| /.env.old \| /.env.old/ \| /.env.prod \| /.env.prod/ \| /.env.production \| /.env.production.local \| /.env.production/ \| /.env.remote \| /.env.sample \| /.env.save \| /.env.save/ \| /.env.secret \| /.env.staging \| /.env.staging/ \| /.env.swp \| /.env.test \| /.env.testing \| /.env/ \| /.env~ \| /.git/COMMIT_EDITMSG \| /.git/HEAD \| /.git/config \| /.git/index \| /.git/logs/HEAD \| /actuator \| /actuator/ \| /actuator/configprops \| /actuator/configprops/ \| /actuator/env \| /actuator/env/ \| /admin/.env \| /api/.env \| /app/.env \| /backend/.env \| /core/.env \| /laravel/.env \| /public/.env \| /server/.env \| /src/.env \| /web/.env \| /www/.env show less	Web App Attack
🇳🇱 Site.eu	2026-07-29 05:29:03 (2 days ago)	Excessive multi-domain requests	Brute-Force
🇫🇮 mickp	2026-07-29 03:46:09 (2 days ago)	18.217.98.239 - - [29/Jul/2026:03:45:18 +0000] "GET / HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Windows NT 1 ... show more 18.217.98.239 - - [29/Jul/2026:03:45:18 +0000] "GET / HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 18.217.98.239 - - [29/Jul/2026:03:45:18 +0000] "GET /under-construction HTTP/1.1" 200 9138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 18.217.98.239 - - [29/Jul/2026:03:45:19 +0000] "GET /Components/Account/Shared/PasskeySubmit.7ozcgj5zvk.razor.js HTTP/1.1" 200 1182 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 18.217.98.239 - - [29/Jul/2026:03:45:20 +0000] "GET /Components/Account/Shared/PasskeySubmit.7ozcgj5zvk.razor.js.map HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 18.217.98.239 - - [29/Jul/2026:03:45:20 +0000] "GET /under-construction HTTP/1.1" 200 9136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 18.217.98.239 - - [29/Jul/2026:03:45:20 +0000] "GET /Components/Layout/ReconnectModal.cyz5k529gx.razor.js HTTP/1.1" 200 579 "-" "Mozilla/5.0 (Window ... show less	Bad Web Bot Web App Attack
🇩🇪 netclix.gr	2026-07-28 23:17:36 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 18.217.98.239 (US/United States/ec2-18- ... show more (mod_security) mod_security triggered on hostname [redacted] 18.217.98.239 (US/United States/ec2-18-217-98-239.us-east-2.compute.amazonaws.com): (CF_ENABLE) show less	SQL Injection
🇺🇸 ruusvuu	2026-07-28 15:21:02 (2 days ago)	Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US. Targeted paths: /actuat ... show more Automated abuse report: 25 attack/probe requests from Amazon.com, Inc. / US. Targeted paths: /actuator, /actuator/env, /actuator/configprops, /jolokia, /wp-config.php.txt. Sample log lines: [fyxit] 18.217.98.239 - - [07/28/2026, 08:21:00] "GET /_ignition/health-check HTTP/1.1" 404 3221 referer:"-" ua:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" [fyxit] 18.217.98.239 - - [07/28/2026, 08:21:00] "GET /telescope HTTP/1.1" 404 3221 referer:"-" ua:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" [fyxit] 18.217.98.239 - - [07/28/2026, 08:21:00] "GET /horizon HTTP/1.1" 404 3221 referer:"-" ua:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" Detected by an automated web-server log monitor. show less	Web App Attack
🇬🇧 Celtic	2026-07-28 12:52:17 (2 days ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇺🇸 mnsf	2026-07-28 12:05:04 (2 days ago)	Too many Status 40X (12) Scanning/Probing (40) Request Overload (103)	Brute-Force Web App Attack
Anonymous	2026-07-28 09:26:57 (2 days ago)	18.217.98.239 - - [28/Jul/2026:11:26:49 +0200] "GET /wp-config.php HTTP/2.0" 404 19328 "-" "Mozilla/ ... show more 18.217.98.239 - - [28/Jul/2026:11:26:49 +0200] "GET /wp-config.php HTTP/2.0" 404 19328 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 06:00:55 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 18.217.98.239 (ec2-18-217-98-239.us-east-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 18.217.98.239 (ec2-18-217-98-239.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 02:00:49.707285 2026] [security2:error] [pid 1346678:tid 1346678] [client 18.217.98.239:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hondabvi.com"] [uri "/.env"] [unique_id "amhFkcoYhjZpiml58CrCagAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-07-28 04:32:30 (3 days ago)	Many_bad_calls	Web App Attack
🇧🇪 taivas.nl	2026-07-28 00:02:14 (3 days ago)	Bad_requests	Bad Web Bot
🇮🇱 spd.co.il	2026-07-27 23:02:24 (3 days ago)	Web application attack detected	Hacking Web App Attack
🇩🇪 FeG Deutschland	2026-07-27 22:27:05 (3 days ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 12	Exploited Host Web App Attack
🇺🇸 ipblock.com	2026-07-27 20:24:00 (3 days ago)	Exploit request, vulnerability scanner.	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 40 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.92

🇺🇸 172.253.223.217

🇳🇱 89.21.67.181

🇳🇱 81.19.216.106

🇳🇱 45.148.10.141

🇬🇧 31.14.254.3

🇧🇴 190.181.4.12

🇧🇷 179.34.69.93

🇸🇬 159.65.5.51

🇨🇳 106.80.180.96

🇸🇬 103.189.235.114

🇷🇴 92.118.39.71

🇫🇷 91.196.152.30

🇳🇱 91.92.42.172

🇳🇱 91.92.40.14

🇫🇮 65.21.2.176

🇺🇸 40.67.183.182

🇨🇦 20.63.10.215

🇳🇱 5.187.35.26

🇹🇷 194.15.52.36