JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.222.80.147

18.222.80.147 was found in our database!

This IP was reported 45 times. Confidence of Abuse is 23%: ?

23%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-222-80-147.us-east-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Columbus, Ohio

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.222.80.147

Whois 18.222.80.147

IP Abuse Reports for 18.222.80.147:

This IP address has been reported a total of 45 times from 27 distinct sources. 18.222.80.147 was first reported on February 7th 2022, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 (1 month ago)	Apache probe; attempts=622; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=622; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.remote \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| /bin/.env \| /bootstrap/.env \| /brevo/.env \| /build/.env \| /buildkite/.env \| /bulk/.env \| /cache/.en \| ... [204 exact paths total] show less	Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-25 22:03:03 (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-24. show less	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-07-24 22:00:48 (1 month ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
Anonymous	2026-07-24 13:05:37 (1 month ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
🇸🇪 konseptit	2026-07-24 12:10:33 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted] 18.222.80.147 (US/United States/ec2-18- ... show more (mod_security) mod_security triggered on hostname [redacted] 18.222.80.147 (US/United States/ec2-18-222-80-147.us-east-2.compute.amazonaws.com) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-07-24 09:38:18 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 18.222.80.147 (ec2-18-222-80-147.us-east-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 18.222.80.147 (ec2-18-222-80-147.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:38:11.216715 2026] [security2:error] [pid 1855660:tid 1855660] [client 18.222.80.147:59066] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pioneercanadian.com"] [uri "/.git/config"] [unique_id "amMyg49B1C35BiqFtf0dwQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Blexyel	2026-07-24 07:35:29 (1 month ago)	18.222.80.147 - - [24/Jul/2026:09:35:28 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 ... show more 18.222.80.147 - - [24/Jul/2026:09:35:28 +0200] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "pingusmc.org" ... show less	Brute-Force Web App Attack
🇺🇦 URAN Publishing Service	2026-07-24 05:54:30 (1 month ago)	18.222.80.147 - - [24/Jul/2026:08:54:27 +0300] "GET /.git/config HTTP/1.1" 404 705 "-" "Mozilla/5.0 ... show more 18.222.80.147 - - [24/Jul/2026:08:54:27 +0300] "GET /.git/config HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:08:54:28 +0300] "GET /.env HTTP/1.1" 404 705 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇪🇸 yvoictra	2026-07-24 03:56:16 (1 month ago)	18.222.80.147 - - [24/Jul/2026:05:56:15 +0200] "GET /.git/config HTTP/1.1" 404 1368 "-" "Mozilla/5.0 ... show more 18.222.80.147 - - [24/Jul/2026:05:56:15 +0200] "GET /.git/config HTTP/1.1" 404 1368 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:56:16 +0200] "GET /.env HTTP/1.1" 404 1368 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:56:16 +0200] "GET /.env.local HTTP/1.1" 404 1368 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:56:16 +0200] "GET /.env.production HTTP/1.1" 404 1368 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:56:16 +0200] "GET /.env.staging HTTP/1.1" 404 1368 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/5 ... show less	Brute-Force Web App Attack
🇩🇪 mr.joecat	2026-07-24 03:55:19 (1 month ago)	18.222.80.147 - - [24/Jul/2026:05:55:18 +0200] "GET /.git/config HTTP/1.1" 404 4268 "-" "Mozilla/5.0 ... show more 18.222.80.147 - - [24/Jul/2026:05:55:18 +0200] "GET /.git/config HTTP/1.1" 404 4268 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:55:18 +0200] "GET /.env HTTP/1.1" 404 4187 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:55:18 +0200] "GET /.env.local HTTP/1.1" 404 4187 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:55:19 +0200] "GET /.env.production HTTP/1.1" 404 4297 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 18.222.80.147 - - [24/Jul/2026:05:55:19 +0200] "GET /.env.staging HTTP/1.1" 404 4234 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Ge ... show less	Web App Attack
🇮🇹 VHosting	2026-07-24 03:30:04 (1 month ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 03:12:25 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 18.222.80.147 (ec2-18-222-80-147.us-east-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 18.222.80.147 (ec2-18-222-80-147.us-east-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 23:12:21.491621 2026] [security2:error] [pid 1692555:tid 1692555] [client 18.222.80.147:40520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pierrebastin.com"] [uri "/.git/config"] [unique_id "amLYFadw5NGlAmZwJJwhEQAAACs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Gwyneth Llewelyn	2022-02-10 02:51:01 (4 years ago)	18.222.80.147 - - [10/Feb/2022:07:50:58 +0000] "GET /.env HTTP/2.0" 301 162 "-" "Mozilla/5.0 (Window ... show more 18.222.80.147 - - [10/Feb/2022:07:50:58 +0000] "GET /.env HTTP/2.0" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0" 2022/02/10 07:50:59 [error] 1678#1678: *449343 access forbidden by rule, client: 18.222.80.147, server: bestasquadradas.org, request: "GET /.env HTTP/2.0", host: "bestasquadradas.org" 18.222.80.147 - - [10/Feb/2022:07:50:59 +0000] "GET /.env HTTP/2.0" 403 813 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0" ... show less	Web App Attack
🇲🇾 syokadmin	2022-02-09 23:52:26 (4 years ago)	(PERMBLOCK) 18.222.80.147 (US/United States/ec2-18-222-80-147.us-east-2.compute.amazonaws.com) has h ... show more (PERMBLOCK) 18.222.80.147 (US/United States/ec2-18-222-80-147.us-east-2.compute.amazonaws.com) has had more than 2 temp blocks in the last 86400 secs show less	Brute-Force
🇳🇿 Tripwire	2022-02-09 23:09:47 (4 years ago)	Scanning for exploits - /.env	Web App Attack

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 121.229.156.119

🇸🇬 114.119.151.59

🇷🇴 92.118.39.71

🇺🇸 48.206.18.152

🇭🇰 45.142.154.35

🇫🇮 45.136.127.194

🇳🇱 34.147.85.17

🇹🇼 198.235.24.112

🇩🇪 185.73.23.133

🇺🇸 184.105.247.203

🇸🇬 114.119.153.209

🇧🇪 104.199.61.252

🇮🇳 98.70.50.166

🇭🇰 45.142.154.18

🇭🇰 219.78.240.92

🇳🇱 195.178.110.30

🇺🇸 172.252.248.134

🇺🇸 172.185.24.228

🇰🇷 121.173.173.48

🇸🇬 114.119.158.167