JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.218.16.254

18.218.16.254 was found in our database!

This IP was reported 46 times. Confidence of Abuse is 0%: ?

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-218-16-254.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.218.16.254

Whois 18.218.16.254

IP Abuse Reports for 18.218.16.254:

This IP address has been reported a total of 46 times from 31 distinct sources. 18.218.16.254 was first reported on January 2nd 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 masterguru	2026-04-18 18:31:20 (1 month ago)	BAD BOT - Detected and Blocked.. Matched phrase "claudebot" at REQUEST_HEADERS:User-Agent. (1100000- ... show more BAD BOT - Detected and Blocked.. Matched phrase "claudebot" at REQUEST_HEADERS:User-Agent. (1100000-122) show less	Bad Web Bot
Anonymous	2024-01-03 08:35:25 (2 years ago)	Web Server Attack	Hacking
🇩🇰 Nieman426	2024-01-03 08:31:00 (2 years ago)	Abusive content scan	Web App Attack
🇬🇷 JCB	2024-01-03 08:08:26 (2 years ago)	18.218.16.254 - - [03/Jan/2024:02:53:11 +0200] "GET /server-status HTTP/1.1" 404 196 "-" "Mozilla/5. ... show more 18.218.16.254 - - [03/Jan/2024:02:53:11 +0200] "GET /server-status HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 18.218.16.254 - - [03/Jan/2024:02:53:11 +0200] "GET /login.sh HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 18.218.16.254 - - [03/Jan/2024:02:53:11 +0200] "GET /config.xml HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" ... show less	Hacking Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2024-01-03 06:12:17 (2 years ago)	4 attacks on password grabbing URLs: GET /root/.aws/credentials HTTP/1.1	Hacking
🇺🇸 TPI-Abuse	2024-01-03 04:52:23 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.comp ... show more (mod_security) mod_security (id:210730) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 02 23:52:18.366462 2024] [security2:error] [pid 9206] [client 18.218.16.254:59566] [client 18.218.16.254] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|192.64.150.119\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.119"] [uri "/config/settings.ini"] [unique_id "ZZToAtuBkT03LsUVjwwE4gAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-01-03 04:49:54 (2 years ago)	[Wed Jan 03 06:49:21.255298 2024] [php7:error] [pid 20491] [client 18.218.16.254:39734] script '/var ... show more [Wed Jan 03 06:49:21.255298 2024] [php7:error] [pid 20491] [client 18.218.16.254:39734] script '/var/www/config.php' not found or unable to stat [Wed Jan 03 06:49:27.244374 2024] [php7:error] [pid 20514] [client 18.218.16.254:43156] script '/var/www/global.php' not found or unable to stat [Wed Jan 03 06:49:33.779822 2024] [php7:error] [pid 20539] [client 18.218.16.254:43358] script '/var/www/Server.php' not found or unable to stat [Wed Jan 03 06:49:43.128138 2024] [php7:error] [pid 20575] [client 18.218.16.254:56534] script '/var/www/settings.php' not found or unable to stat [Wed Jan 03 06:49:53.804237 2024] [php7:error] [pid 20616] [client 18.218.16.254:48538] script '/var/www/debug.php' not found or unable to stat ... show less	DDoS Attack Exploited Host Web App Attack
🇬🇧 Cracking-Host.uk	2024-01-03 04:46:04 (2 years ago)	(mod_security) mod_security triggered on hostname [redacted] 18.218.16.254 (US/United States/Ohio/Co ... show more (mod_security) mod_security triggered on hostname [redacted] 18.218.16.254 (US/United States/Ohio/Columbus/ec2-18-218-16-254.us-east-2.compute.amazonaws.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2024-01-03 04:04:21 (2 years ago)	(mod_security) mod_security (id:210492) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 02 23:04:15.373033 2024] [security2:error] [pid 14446] [client 18.218.16.254:56014] [client 18.218.16.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.71"] [uri "/web.config.tmp"] [unique_id "ZZTcvwHR_P-PxbqoLzjMBQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 Mediashaker	2024-01-03 04:01:47 (2 years ago)	(mod_security) mod_security triggered on hostname [redacted] 18.218.16.254 (US/United States/ec2-18- ... show more (mod_security) mod_security triggered on hostname [redacted] 18.218.16.254 (US/United States/ec2-18-218-16-254.us-east-2.compute.amazonaws.com) show less	SQL Injection
🇳🇱 Savvii	2024-01-03 04:00:19 (2 years ago)	20 attempts against mh-misbehave-ban on grain	Brute-Force Bad Web Bot Web App Attack
🇺🇸 dpinse	2024-01-03 03:44:33 (2 years ago)	Suspicious URL access.	Hacking
🇳🇱 Savvii	2024-01-03 03:17:42 (2 years ago)	20 attempts against mh-misbehave-ban on pluto	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-01-03 02:55:20 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.comp ... show more (mod_security) mod_security (id:210730) triggered by 18.218.16.254 (ec2-18-218-16-254.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 02 21:55:14.626167 2024] [security2:error] [pid 9001] [client 18.218.16.254:33244] [client 18.218.16.254] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|192.64.150.65\|F\|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.65"] [uri "/config/settings.ini"] [unique_id "ZZTMksDgfqkoYUBztCD84AAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2024-01-03 02:43:56 (2 years ago)	20 attempts against mh-misbehave-ban on plum	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 46 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.180.246.3

🇧🇴 181.188.176.242

🇸🇬 172.253.236.217

🇺🇸 162.216.150.17

🇺🇸 162.216.149.98

🇨🇦 159.89.127.34

🇺🇸 147.185.132.14

🇸🇬 43.160.212.102

🇬🇧 35.203.210.165

🇺🇸 23.129.64.145

🇮🇳 182.95.185.158

🇺🇸 172.56.12.138

🇮🇳 124.253.212.104

🇻🇳 103.118.29.7

🇸🇰 91.223.69.87

🇳🇱 91.92.40.4

🇺🇸 76.87.11.164

🇩🇪 46.101.127.96

🇳🇱 45.148.10.151

🇯🇵 180.5.55.227