AbuseIPDB » 18.230.85.242

18.230.85.242 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 32%: ?

32%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	ec2-18-230-85-242.sa-east-1.compute.amazonaws.com
Domain Name	amazon.com
Country	Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 18.230.85.242

Whois 18.230.85.242

IP Abuse Reports for 18.230.85.242:

This IP address has been reported a total of 49 times from 32 distinct sources. 18.230.85.242 was first reported on July 15th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
hanb.jp	2024-07-18 01:43:48 (1 month ago)	Jul 18 01:43:30 v4bgp sshd[1853926]: Failed password for root from 18.230.85.242 port 43734 ssh2<br ... show moreJul 18 01:43:30 v4bgp sshd[1853926]: Failed password for root from 18.230.85.242 port 43734 ssh2 Jul 18 01:43:46 v4bgp sshd[1853928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 18 01:43:48 v4bgp sshd[1853928]: Failed password for root from 18.230.85.242 port 39864 ssh2 ... show less	Brute-Force SSH
bigscoots.com	2024-07-17 22:16:18 (1 month ago)	(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws. ... show more(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jul 17 17:15:26 21384 sshd[32350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 17 17:15:28 21384 sshd[32350]: Failed password for root from 18.230.85.242 port 48876 ssh2 Jul 17 17:15:45 21384 sshd[32353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 17 17:15:46 21384 sshd[32353]: Failed password for root from 18.230.85.242 port 46324 ssh2 Jul 17 17:16:02 21384 sshd[32355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root show less	Brute-Force SSH
security.rdmc.fr	2024-07-17 17:11:13 (1 month ago)	Port Scan Attack proto:TCP src:19271 dst:23	Port Scan
bigscoots.com	2024-07-17 17:00:16 (1 month ago)	(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws. ... show more(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jul 17 16:59:16 23276 sshd[4680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 17 16:59:19 23276 sshd[4680]: Failed password for root from 18.230.85.242 port 58298 ssh2 Jul 17 16:59:42 23276 sshd[4682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=nobody Jul 17 16:59:44 23276 sshd[4682]: Failed password for nobody from 18.230.85.242 port 55026 ssh2 Jul 17 16:59:59 23276 sshd[4684]: Invalid user plexuser from 18.230.85.242 port 53786 show less	Brute-Force SSH
NeverBehave	2024-07-17 12:22:17 (1 month ago)	Fail2ban Triggered	Brute-Force SSH
KPS	2024-07-17 07:55:52 (1 month ago)	PortscanM	Port Scan
ivotonev	2024-07-17 04:01:01 (1 month ago)	SSH login bruteforce	Brute-Force SSH
bigscoots.com	2024-07-17 00:08:12 (1 month ago)	(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws. ... show more(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jul 16 19:07:27 14961 sshd[7574]: Invalid user client from 18.230.85.242 port 50926 Jul 16 19:07:28 14961 sshd[7574]: Failed password for invalid user client from 18.230.85.242 port 50926 ssh2 Jul 16 19:07:44 14961 sshd[7578]: Invalid user minecraft from 18.230.85.242 port 40008 Jul 16 19:07:45 14961 sshd[7578]: Failed password for invalid user minecraft from 18.230.85.242 port 40008 ssh2 Jul 16 19:08:01 14961 sshd[7580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root show less	Brute-Force SSH
TPI-Abuse	2024-07-16 19:00:03 (1 month ago)	(mod_security) mod_security (id:211220) triggered by 18.230.85.242 (ec2-18-230-85-242.sa-east-1.comp ... show more(mod_security) mod_security (id:211220) triggered by 18.230.85.242 (ec2-18-230-85-242.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 16 14:59:56.673309 2024] [security2:error] [pid 19149:tid 19149] [client 18.230.85.242:59182] [client 18.230.85.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack\|\|192.64.150.155:80\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.155"] [uri "/index.php"] [unique_id "ZpbDLMd1fm8y5DlCJXWGDQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
RAP	2024-07-16 17:00:27 (1 month ago)	2024-07-16 17:00:27 UTC Unauthorized activity to TCP port 22. SSH	SSH
bigscoots.com	2024-07-16 14:23:51 (1 month ago)	(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws. ... show more(sshd) Failed SSH login from 18.230.85.242 (BR/Brazil/ec2-18-230-85-242.sa-east-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jul 16 09:23:11 16591 sshd[19662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 16 09:23:12 16591 sshd[19662]: Failed password for root from 18.230.85.242 port 53508 ssh2 Jul 16 09:23:27 16591 sshd[19666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root Jul 16 09:23:29 16591 sshd[19666]: Failed password for root from 18.230.85.242 port 54996 ssh2 Jul 16 09:23:44 16591 sshd[19672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.230.85.242 user=root show less	Brute-Force SSH
Smel	2024-07-16 11:45:08 (1 month ago)	MH/MP Probe, Scan, Hack -	Port Scan Hacking
FireballDWF	2024-07-16 02:15:10 (1 month ago)	404 NOT FOUND	Web App Attack
ThreatBook.io	2024-07-15 22:03:02 (1 month ago)	ThreatBook Intelligence: Edu,Zombie more details on https://threatbook.io/ip/18.230.85.242	Brute-Force
Block_Steady_Crew	2024-07-15 19:20:28 (2 months ago)	Honeypot snared from 18.230.85.242	Port Scan Web App Attack