JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

18.246.6.20

Neutral Activity

Abuse Confidence Score

0% Low Risk

43 reports

36 reporters · latest 2 years ago

ISP: Amazon.com, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-18-246-6-20.us-west-2.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇺🇸 United States of America
City: Boardman, Oregon

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

18.246.6.20 has been reported 43 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

43 from 36 distinct reporters

First reported

February 4th 2024

Most recent report

2 years ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 urmarcht	2024-02-06 10:58:00 UTC · (2 years ago)	Bot attack detected : webscan vurnerability	Web App Attack
🇨🇭 backslash	2024-02-06 10:19:50 UTC · (2 years ago)		Bad Web Bot
🇫🇷 geot	2024-02-05 13:11:51 UTC · (2 years ago)	JavaScript scanning bot	Hacking Bad Web Bot Web App Attack
Anonymous	2024-02-05 11:22:12 UTC · (2 years ago)	Attempting .js logins, etc	Web Spam Hacking Web App Attack
🇧🇪 taivas.nl	2024-02-05 05:32:36 UTC · (2 years ago)	Many_bad_calls	Web App Attack
🇬🇧 Wessex	2024-02-04 21:22:02 UTC · (2 years ago)	Attempting .js logins, etc	Hacking SQL Injection Brute-Force
🇺🇸 anon333	2024-02-04 17:33:59 UTC · (2 years ago)	Hacker syslog review x 8359.656852584	Hacking
🇺🇸 TPI-Abuse	2024-02-04 16:23:53 UTC · (2 years ago)	(mod_security) mod_security (id:210831) triggered by 18.246.6.20 (ec2-18-246-6-20.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 11:23:46.378946 2024] [security2:error] [pid 118 ... show more (mod_security) mod_security (id:210831) triggered by 18.246.6.20 (ec2-18-246-6-20.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 11:23:46.378946 2024] [security2:error] [pid 11873] [client 18.246.6.20:57084] [client 18.246.6.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|scothart.com\|F\|4"] [data "grub-client"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "scothart.com"] [uri "/"] [unique_id "Zb-6Eo9alHOj0xeluh-aBAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-02-04 16:21:45 UTC · (2 years ago)	Portscan: TCP/443 (4x), TCP/80 (2x)	Port Scan
🇨🇦 Justmee	2024-02-04 15:02:44 UTC · (2 years ago)	Feb 4 08:02:42 server1 kernel: [12100483.409724] IPTABLES: IN=eth0 OUT= MAC=00:22:19:d7:2c:94:04:42:1a:61:50:d8:08:00 SRC=18.246.6.20 DST=192.168.100.3 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=40571 DF PROTO=TCP SPT=44104 DPT=443 WINDOW=62727 RES=0x00 SY ... show more Feb 4 08:02:42 server1 kernel: [12100483.409724] IPTABLES: IN=eth0 OUT= MAC=00:22:19:d7:2c:94:04:42:1a:61:50:d8:08:00 SRC=18.246.6.20 DST=192.168.100.3 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=40571 DF PROTO=TCP SPT=44104 DPT=443 WINDOW=62727 RES=0x00 SYN URGP=0 Feb 4 08:02:43 server1 kernel: [12100484.402623] IPTABLES: IN=eth0 OUT= MAC=00:22:19:d7:2c:94:04:42:1a:61:50:d8:08:00 SRC=18.246.6.20 DST=192.168.100.3 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=31930 DF PROTO=TCP SPT=57256 DPT=80 WINDOW=62727 RES=0x00 SYN URGP=0 Feb 4 08:02:44 server1 kernel: [12100485.428604] IPTABLES: IN=eth0 OUT= MAC=00:22:19:d7:2c:94:04:42:1a:61:50:d8:08:00 SRC=18.246.6.20 DST=192.168.100.3 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=31931 DF PROTO=TCP SPT=57256 DPT=80 WINDOW=62727 RES=0x00 SYN URGP=0 ... show less	Hacking Brute-Force
Anonymous	2024-02-04 14:50:02 UTC · (2 years ago)	\| Blacklisted user agent (known malicious user agent).	Hacking SQL Injection Web App Attack
🇺🇸 TPI-Abuse	2024-02-04 14:37:56 UTC · (2 years ago)	(mod_security) mod_security (id:210831) triggered by 18.246.6.20 (ec2-18-246-6-20.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 09:37:51.704823 2024] [security2:error] [pid 318 ... show more (mod_security) mod_security (id:210831) triggered by 18.246.6.20 (ec2-18-246-6-20.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 04 09:37:51.704823 2024] [security2:error] [pid 3189] [client 18.246.6.20:54024] [client 18.246.6.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|tsodatahub.com\|F\|4"] [data "Microsoft URL"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "tsodatahub.com"] [uri "/cdn.js"] [unique_id "Zb-hPygc13b6htzDMwIHJAAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Nightreaver	2024-02-04 14:25:59 UTC · (2 years ago)	18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /keyhandler.js HTTP/1.1" 404 5611 "-" "Nokia6630/1.0 (2.39.15) SymbianOS/8.0 Series60/2.6 Profile/MIDP-2.0 Configuration/CLDC-1.1" 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /console.js HTTP/1. ... show more 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /keyhandler.js HTTP/1.1" 404 5611 "-" "Nokia6630/1.0 (2.39.15) SymbianOS/8.0 Series60/2.6 Profile/MIDP-2.0 Configuration/CLDC-1.1" 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /console.js HTTP/1.1" 404 5611 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36" 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /functions.js HTTP/1.1" 404 5611 "-" "Opera/9.64 (Macintosh; PPC Mac OS X; U; en) Presto/2.1.1" 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /vendor/jquery/jquery-migrate.js HTTP/1.1" 404 5611 "-" "Mozilla/5.0 (Linux; Android 11; SM-G980F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36" 18.246.6.20 - - [04/Feb/2024:15:25:58 0100] "GET /vendor/codemirror/addon/lint/lint.js HTTP/1.1" 404 5611 "-" "Mozilla/5.0 (Unknown; UNIX BSD/SYSV system) AppleWebKit/538.1 (KHTML, like Gecko) QupZilla/1.7.0 Safari/538.1" 18.246.6.20 - - [04/Feb/2024:15:25[...] show less	Bad Web Bot Web App Attack
🇬🇧 Epimetheus	2024-02-04 12:38:11 UTC · (2 years ago)	Unauthorized access attempts: From: 18.246.6.20 Method: HTTPS GET URI Path: //static.cloudflareinsights.com/beacon.min.js UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/ ... show more Unauthorized access attempts: From: 18.246.6.20 Method: HTTPS GET URI Path: //static.cloudflareinsights.com/beacon.min.js UA: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" show less	Web App Attack
🇺🇸 Zandro	2024-02-04 12:30:41 UTC · (2 years ago)	GET //cse.google.com/cse.js	Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 162.216.149.135

🇷🇴 92.118.39.49

🇺🇸 69.46.65.137

🇸🇬 43.134.62.67

🇷🇺 185.231.155.169

🇳🇱 185.218.86.10

🇺🇸 147.90.234.14

🇧🇩 116.206.253.19

🇬🇧 104.28.160.255

🇺🇸 70.183.226.30

🇺🇸 68.225.61.18

🇲🇾 59.153.151.174

🇬🇧 45.135.142.117

🇩🇪 45.87.70.198

🇧🇪 35.195.38.98

🇭🇰 20.255.63.133

🇺🇸 207.120.8.120

🇺🇸 172.233.135.159

🇰🇷 121.133.167.123

🇯🇵 103.143.72.165