JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

18.237.207.12

Recent Activity

Abuse Confidence Score

100% Critical

30 reports

29 reporters · latest 2 days ago

ISP: Amazon.com, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-18-237-207-12.us-west-2.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇺🇸 United States of America
City: Boardman, Oregon

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

30 from 29 distinct reporters

First reported

November 4th 2026

Most recent report

2 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 8 🇩🇪 Germany 3 🇫🇷 France 3

Most common categories Web App Attack 25 Bad Web Bot 11 Brute-Force 9 Hacking 8 Port Scan 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 radardatelecom	2026-11-04 16:53:05 UTC · (2 days ago)	Blocked by Radar da Telecom firewall — abuseipdb	Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-11-04 15:25:59 UTC · (2 days ago)	2.293 requests with url.path config.yaml 1.975 requests with url.path config.toml 1.139 requests with url.path config.yml 346 requests with url.path compose.yml 330 requests with url.path .config/ 305 requests with url.path compose.yaml ... show more 2.293 requests with url.path config.yaml 1.975 requests with url.path config.toml 1.139 requests with url.path config.yml 346 requests with url.path compose.yml 330 requests with url.path .config/* 305 requests with url.path compose.yaml 185 requests with url.path .git/* show less	Brute-Force Bad Web Bot
🇨🇭 4server	2026-11-04 15:13:23 UTC · (3 days ago)	[WedNov0416:13:18.6105642026][security2:error][pid3543766:tid3543885][client18.237.207.12:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/ ... show more [WedNov0416:13:18.6105642026][security2:error][pid3543766:tid3543885][client18.237.207.12:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"735\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"whatsdecor.ch\"][uri\"/wp-content/plugins/sitepress-multilingual-cms/readme.txt\"][unique_id\"autLjnwGhPHo3wQ_TO6dAwAAAA8\"] show less	Hacking Web App Attack
🇫🇷 hghosting	2026-11-04 15:10:58 UTC · (3 days ago)	CrowdSec auto-report: crowdsecurity/http-probing — 11 events	Brute-Force SSH
🇺🇸 mnsf	2026-11-04 15:05:38 UTC · (3 days ago)	Abuse Detected (9)	Brute-Force Web App Attack
Anonymous	2026-11-04 15:05:07 UTC · (3 days ago)	Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=44	Hacking
🇺🇸 TPI-Abuse	2026-11-04 15:01:48 UTC · (3 days ago)	(mod_security) mod_security (id:210730) triggered by 18.237.207.12 (ec2-18-237-207-12.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:01:42.390797 2026] [security2:error] [pid ... show more (mod_security) mod_security (id:210730) triggered by 18.237.207.12 (ec2-18-237-207-12.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 10:01:42.390797 2026] [security2:error] [pid 5990:tid 5990] [client 18.237.207.12:46892] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.nymarts.com\|F\|2"] [data ".env.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.nymarts.com"] [uri "/.env.backup"] [unique_id "autI1hLKqE0gHO1QtGMMrgAAACo"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇺 kranem	2026-11-04 15:00:12 UTC · (3 days ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) Protocol: HTTP/2 (GET method) Endpoint: / Timestamp: 2026-11-04T14:39:35Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/1 ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 16509 (Amazon.com, Inc.) Protocol: HTTP/2 (GET method) Endpoint: / Timestamp: 2026-11-04T14:39:35Z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0 show less	Bad Web Bot
🇳🇱 debestelapp	2026-11-04 15:00:09 UTC · (3 days ago)		Web App Attack
🇩🇪 Lino Project	2026-11-04 14:53:53 UTC · (3 days ago)	18.237.207.12 - - [04/Nov/2026:15:53:48 +0100] "GET /administrator/manifests/files/joomla.xml HTTP/2.0" 404 136380 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" ...	Brute-Force Bad Web Bot Web App Attack
🇺🇸 johnp	2026-11-04 14:52:44 UTC · (3 days ago)	Hostile web requests to a website: /app/config.yaml, /config/config.yaml, /config/config.toml, /app/config.yml, /src/config.yaml, /.config/app.yaml (20 requests, 2026-11-04 14:52:43 UTC to 2026-11-04 14:52:44 UTC). User agent: MerchantSecurityScanner ... show more Hostile web requests to a website: /app/config.yaml, /config/config.yaml, /config/config.toml, /app/config.yml, /src/config.yaml, /.config/app.yaml (20 requests, 2026-11-04 14:52:43 UTC to 2026-11-04 14:52:44 UTC). User agent: MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner) show less	Hacking Web App Attack
🇬🇧 Aetherweb Ark	2026-11-04 14:41:07 UTC · (3 days ago)	(mod_security) mod_security (id:949110) triggered by 18.237.207.12 (US/United States/ec2-18-237-207-12.us-west-2.compute.amazonaws.com): N in the last X secs	Web App Attack
🇦🇺 rubixstudios	2026-11-04 14:37:02 UTC · (3 days ago)	Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360	DDoS Attack Brute-Force Web App Attack
🇧🇪 taivas.nl	2026-11-04 14:32:05 UTC · (3 days ago)	Bad_requests	Bad Web Bot
🇨🇦 Anytech	2026-11-04 14:21:03 UTC · (3 days ago)	Blocked by Conn-Monitor: env-probing	Web App Attack Hacking

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 213.209.159.175

🇺🇸 155.2.215.82

🇺🇸 152.163.101.244

🇺🇸 91.193.232.34

🇺🇸 45.132.227.83

🇯🇵 43.167.207.58

🇩🇪 43.157.54.144

🇺🇸 43.135.183.2

🇲🇽 38.22.164.235

🇨🇳 202.103.55.158

🇺🇸 172.59.84.249

🇮🇳 165.99.85.47

🇺🇸 152.163.101.152

🇺🇸 148.135.10.48

🇨🇳 123.160.173.244

🇧🇩 103.234.203.143

🇺🇸 103.196.9.44

🇳🇱 81.171.72.135

🇯🇵 47.245.9.17

🇧🇬 46.55.162.29