JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.94.85.181

54.94.85.181 was found in our database!

This IP was reported 282 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Brazil
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-94-85-181.sa-east-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.94.85.181

Whois 54.94.85.181

IP Abuse Reports for 54.94.85.181:

This IP address has been reported a total of 282 times from 145 distinct sources. 54.94.85.181 was first reported on October 2nd 2026, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Alt255	2026-10-26 21:19:44 (13 hours ago)	[ti-14al] Web exploit scanning: 14 suspicious requests detected by fail2ban jail <name>. Example: 54 ... show more [ti-14al] Web exploit scanning: 14 suspicious requests detected by fail2ban jail <name>. Example: 54.94.85.181 - - [20/Oct/2026:00:29:56 +0200] "GET /.env.old HTTP/1.1" 301 5900 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/110.0" 54.94.85.181 - - [20/Oct/2026:00:29:56 +0200] "GET /.env.test HTTP/1.1" 301 5901 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/110.0" 54.94.85.181 - - [20/Oct/2026:00:29:56 +0200] "GET /wp-config.php.old HTTP/1.1" 301 5909 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/110.0" 54.94.85.181 - - [20/Oct/2026:00:29:56 +0200] "GET /.git/config HTTP/1.1" 301 5903 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefo ... show less	Bad Web Bot Web App Attack
🇳🇱 Alt255	2026-10-25 13:46:32 (1 day ago)	[ti-tinov] Web exploit scanning: 13 suspicious requests detected by fail2ban jail <name>. Example: 5 ... show more [ti-tinov] Web exploit scanning: 13 suspicious requests detected by fail2ban jail <name>. Example: 54.94.85.181 - - [21/Oct/2026:03:13:39 +0200] "GET /.env.prod HTTP/1.1" 404 7197 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0" 54.94.85.181 - - [21/Oct/2026:03:13:39 +0200] "GET /.env.production HTTP/1.1" 404 7197 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0" 54.94.85.181 - - [21/Oct/2026:03:13:39 +0200] "GET /.env HTTP/1.1" 404 7197 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0" 54.94.85.181 - - [21/Oct/2026:03:13:39 +0200] "GET /wp-config.php.bak HTTP/1.1" 404 7197 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/2010010 ... show less	Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-10-25 03:16:02 (2 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-10-23 03:15:53 (4 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇧🇷 Peregrine	2026-10-22 03:12:18 (5 days ago)	Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 -030 ... show more Fail2Ban ct101 Jail: tomcat-404 \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 -0300] "GET /Web.config HTTP/1.1" 404 18193 54.94.85.181 104.23.254.160 - - [21/Oct/2026:07:58:02 -0300] "GET /app/.env HTTP/1.1" 404 18193 54.94.85.181 172.69.39.18 - - [21/Oct/2026:07:58:02 -0300] "GET /backup.sql HTTP/1.1" 404 18193 54.94.85.181 172.71.234.254 - - [21/Oct/2026:07:58:02 -0300] "GET /aws-exports.js HTTP/1.1" 404 18193 54.94.85.181 104.23.254.94 - - [21/Oct/2026:07:58:02 -0300] "GET /firebase.js HTTP/1.1" 404 18193 show less	Bad Web Bot Web App Attack
Anonymous	2026-10-21 12:41:23 (5 days ago)	54.94.85.181 detected on srv01	Brute-Force
🇩🇪 updown.io	2026-10-21 12:36:13 (5 days ago)	{"level":"info","ts":1792586172.0233772,"logger":"http.log.access.log1","msg":"handled request","req ... show more {"level":"info","ts":1792586172.0233772,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"54.94.85.181","remote_port":"60028","client_ip":"54.94.85.181","proto":"HTTP/1.1","method":"GET","host":"status.bagdemo.nl","uri":"/.envrc","headers":{"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.4.20"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.bagdemo.nl","ech":false}},"bytes_read":0,"user_id":"","duration":0.000641825,"size":0,"status":429,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"],"Server":["Caddy"]}} {"level":"info","ts":1792586172.0248175,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"54.94.85.181","remote_port":"59892" ... show less	DDoS Attack Web App Attack
Anonymous	2026-10-21 12:34:45 (5 days ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇵🇱 sefinek.net	2026-10-21 11:28:48 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from BR. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoi ... show more Triggered Cloudflare WAF (firewallCustom) from BR. Action: BLOCK \| Protocol: HTTP/1.1 (GET) \| Endpoint: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-10-21 11:10:00 (5 days ago)	IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/appsec-vpatch; Action=ban; Events=2; Co ... show more IncogNET WAF local CrowdSec decision. Scenario=crowdsecurity/appsec-vpatch; Action=ban; Events=2; Country=BR; ASN=16509 AMAZON-02 show less	Hacking
🇩🇪 bescared	2026-10-21 10:58:36 (5 days ago)	F2B - Malicious activity detected. URL Probing. -151302cd-	Hacking Bad Web Bot Web App Attack
🇧🇷 Peregrine	2026-10-21 10:58:06 (5 days ago)	Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 ... show more Fail2Ban ct101 Jail: tomcat-honeypot \| Evidence: 54.94.85.181 172.71.6.160 - - [21/Oct/2026:07:58:02 -0300] "GET /.git/config HTTP/1.1" 404 18193 show less	Bad Web Bot
🇵🇱 Budyn	2026-10-21 10:47:11 (5 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: grafana.astropot.website \| URI: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇺🇸 Rip	2026-10-21 10:41:30 (5 days ago)	403 Errors: Access Forbidden	Brute-Force
🇨🇿 sweet_acid	2026-10-21 09:08:46 (6 days ago)	Local web evidence: family=path_probe; path=/wp-config.php.bak; enforce_count=10; active_ban_hits=0	Web App Attack

Showing 1 to 15 of 282 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 202.164.42.142

🇨🇳 180.153.91.15

🇺🇸 165.154.173.104

🇮🇳 122.180.242.27

🇫🇷 104.23.225.22

🇭🇰 65.181.71.117

🇺🇸 65.49.1.59

🇺🇸 50.6.205.37

🇳🇱 45.148.10.5

🇻🇳 42.96.19.37

🇨🇳 39.164.94.190

🇰🇷 39.120.34.60

🇺🇸 35.243.233.87

🇺🇸 34.162.93.181

🇸🇬 8.222.225.214

🇧🇷 181.191.129.132

🇧🇷 177.125.95.88

🇺🇸 162.216.149.22

🇻🇳 160.191.55.6

🇸🇬 152.42.215.250