JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 18.231.185.159

18.231.185.159 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 70%: ?

70%

ISP	Amazon Data Services Brazil
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-18-231-185-159.sa-east-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 18.231.185.159

Whois 18.231.185.159

IP Abuse Reports for 18.231.185.159:

This IP address has been reported a total of 21 times from 15 distinct sources. 18.231.185.159 was first reported on July 14th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-17 09:03:38 (1 week ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇫🇮 indev.fi	2026-07-17 02:18:52 (1 week ago)	alalipasti.peltopiri.com 18.231.185.159 - - [17/Jul/2026:05:18:22 +0300] "GET /.git/config HTTP/1.1" ... show more alalipasti.peltopiri.com 18.231.185.159 - - [17/Jul/2026:05:18:22 +0300] "GET /.git/config HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" alalipasti.peltopiri.com 18.231.185.159 - - [17/Jul/2026:05:18:24 +0300] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" alalipasti.peltopiri.com 18.231.185.159 - - [17/Jul/2026:05:18:24 +0300] "GET /.env.local HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Port Scan Hacking Bad Web Bot Web App Attack
🇩🇪 NihiliousMonk	2026-07-16 17:45:12 (1 week ago)	Fail2Ban report from jail npm-scanners	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 16:35:19 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 12:35:11.881545 2026] [security2:error] [pid 19280:tid 19280] [client 18.231.185.159:47068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "knowyourcode.us"] [uri "/.git/config"] [unique_id "alkIP_RsqhFudM3Aiv0oUQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 15:05:42 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 11:05:36.909094 2026] [security2:error] [pid 5789:tid 5789] [client 18.231.185.159:34664] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "knowbuddy.org"] [uri "/.git/config"] [unique_id "aljzQO7RCJ5YphfWeXHLywAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-16 09:50:54 (1 week ago)	(mod_security) mod_security triggered on hostname [redacted] 18.231.185.159 (BR/Brazil/ec2-18-231-18 ... show more (mod_security) mod_security triggered on hostname [redacted] 18.231.185.159 (BR/Brazil/ec2-18-231-185-159.sa-east-1.compute.amazonaws.com) show less	SQL Injection
Anonymous	2026-07-16 08:03:34 (1 week ago)	Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: Word ... show more Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: BR, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 07:58:49 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 03:58:45.924182 2026] [security2:error] [pid 18095:tid 18095] [client 18.231.185.159:51240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kneupper.com"] [uri "/.git/config"] [unique_id "aliPNTsQdHBEzux9MdUrpwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Holger	2026-07-16 07:40:17 (1 week ago)	URL probing: GET /.env	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 02:48:31 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 22:48:27.223181 2026] [security2:error] [pid 22681:tid 22681] [client 18.231.185.159:51750] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kmelson.com"] [uri "/.git/config"] [unique_id "alhGe43BUb3SlmvBISc6jAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-16 02:27:16 (1 week ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
🇺🇸 TPI-Abuse	2026-07-16 01:55:42 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 21:55:37.299326 2026] [security2:error] [pid 9603:tid 9603] [client 18.231.185.159:35072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kmashburn.com"] [uri "/.git/config"] [unique_id "alg6GdxqadQG52RdvfKNOgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-16 00:28:59 (1 week ago)	Excessive 404/403 errors	Brute-Force
🇪🇸 alferez	2026-07-15 16:36:18 (1 week ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 13:28:14 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 18.231.185.159 (ec2-18-231-185-159.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 09:28:07.702414 2026] [security2:error] [pid 5490:tid 5579] [client 18.231.185.159:54090] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.ergpd.com"] [uri "/.git/config"] [unique_id "aleK590ljk8dRBfwi2hJbQAAAcg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 182.31.15.205

🇨🇳 139.227.161.152

🇺🇸 108.162.245.22

🇮🇪 54.217.55.186

🇺🇸 2a04:4e40:e040:0:f22:41bc:137d:567

🇩🇪 167.94.146.49

🇳🇱 138.226.239.3

🇮🇳 49.47.141.142

🇨🇳 43.138.247.211

🇪🇸 217.160.136.123

🇰🇷 211.119.114.252

🇧🇷 177.96.139.231

🇮🇳 115.99.56.148

🇨🇦 85.217.149.65

🇱🇹 77.90.185.79

🇳🇱 45.198.224.5

🇧🇪 34.78.29.97

🇳🇱 5.253.59.68

🇳🇱 5.61.209.44

🇵🇭 223.25.56.4