AbuseIPDB » 18.246.38.27
18.246.38.27
This IP was reported 7 times. Confidence of
Abuse
is 51% : ?
ISP
Amazon.com, Inc.
Usage Type
Data Center/Web Hosting/Transit
ASN
AS16509
Hostname(s)
ec2-18-246-38-27.us-west-2.compute.amazonaws.com
Domain Name
amazon.com
Country
🇺🇸
United States of America
City
Boardman, Oregon
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 18.246.38.27 :
This IP address has been reported a total of
7
times from
7 distinct
sources.
18.246.38.27 was first reported on
October 26th 2026 , and the most recent report was
6 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇲🇽
octageeks.com
2026-10-27 04:33:00
(6 hours ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 10:20:55
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 18.246.38.27 (ec2-18-246-38-27.us-west-2.comput ...
show more
(mod_security) mod_security (id:210492) triggered by 18.246.38.27 (ec2-18-246-38-27.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 06:20:50.765028 2026] [security2:error] [pid 26633:tid 26633] [client 18.246.38.27:39384] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.daveslawncare.com"] [uri "/.git/COMMIT_EDITMSG"] [unique_id "at8pgoXVK1LiNK9gbhaM7gAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-26 10:05:20
(1 day ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇩🇪
LRob
2026-10-26 10:02:53
(1 day ago)
Technology fingerprinting | method: GET | path: /core/install.php | ua: MerchantSecurityScanner/1.0 ...
show more
Technology fingerprinting | method: GET | path: /core/install.php | ua: MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)
show less
Port Scan
Web App Attack
🇳🇱
Site.eu
2026-10-26 10:02:43
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇳🇱
melroy89
2026-10-26 09:57:55
(1 day ago)
18.246.38.27 - - [26/Oct/2026:10:57:25 +0100] "GET /config.toml HTTP/2.0" 403 512 "-" "MerchantSecu ...
show more
18.246.38.27 - - [26/Oct/2026:10:57:25 +0100] "GET /config.toml HTTP/2.0" 403 512 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" "melroy.org" 0.000
18.246.38.27 - - [26/Oct/2026:10:57:25 +0100] "GET /config.yaml HTTP/2.0" 403 512 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" "melroy.org" 0.000
18.246.38.27 - - [26/Oct/2026:10:57:25 +0100] "GET /config.yml HTTP/2.0" 403 512 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" "melroy.org" 0.001
18.246.38.27 - - [26/Oct/2026:10:57:25 +0100] "GET /app/config.toml HTTP/2.0" 403 512 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" "melroy.org" 0.001
18.246.38.27 - - [26/Oct/2026:10:57:26 +0100] "GET /app/config.yaml HTTP/2.0" 403 512 "-" "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)" "melroy.org" 0.000
18.246.38.27 - - [26/Oct/2026:10:57:26 +0100] "GET /config/config.yaml H
...
show less
Web App Attack
🇳🇱
debestelapp
2026-10-26 09:30:10
(1 day ago)
Web App Attack
Showing 1 to
7
of 7 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: