JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 100.54.217.213

100.54.217.213 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 90%: ?

90%

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-100-54-217-213.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 100.54.217.213

Whois 100.54.217.213

IP Abuse Reports for 100.54.217.213:

This IP address has been reported a total of 18 times from 16 distinct sources. 100.54.217.213 was first reported on October 16th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-10-17 13:29:54 (1 hour ago)	(mod_security) mod_security (id:949110) triggered by 100.54.217.213 (ec2-100-54-217-213.compute-1.am ... show more (mod_security) mod_security (id:949110) triggered by 100.54.217.213 (ec2-100-54-217-213.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:29:48.904993 2026] [security2:error] [pid 13951:tid 13951] [client 100.54.217.213:64201] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "donkeywaffle.com"] [uri "/wp-config.php"] [unique_id "atN4TM14FPmxSCqJ0l3OTgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 j-tap	2026-10-17 13:28:31 (1 hour ago)	WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)	Web App Attack
🇫🇷 regishoussin	2026-10-17 12:33:20 (2 hours ago)	Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of ... show more Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-17 12:33 UTC. show less	Bad Web Bot Web App Attack
🇺🇸 ArturShelby	2026-10-17 12:23:18 (3 hours ago)	Suspicious file access: /.well-known/file.php	Web App Attack
🇧🇪 cmbplf	2026-10-17 11:26:53 (3 hours ago)	117 requests with url.path /wp-admin/images/about.php 111 requests with url.path /wp.php 51 req ... show more 117 requests with url.path /wp-admin/images/about.php 111 requests with url.path /wp.php 51 requests with url.path */wp-sigunq.php show less	Brute-Force Bad Web Bot
🇺🇸 mnsf	2026-10-17 11:05:13 (4 hours ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇳🇱 Alt255	2026-10-17 10:41:04 (4 hours ago)	[ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ... show more [ti-01al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 100.54.217.213 - - [17/Oct/2026:12:40:55 +0200] "GET /inputs.php HTTP/1.1" 404 2110 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:12:40:55 +0200] "GET /classsmtps.php HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:12:40:55 +0200] "GET /wp-blog-header.php HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:12:40:56 +0200] "GET /wp-trackback.php HTTP/1.1" 404 2083 "-" "Mozilla/5.0 (Windows NT 10. ... show less	Bad Web Bot Web App Attack
Anonymous	2026-10-17 10:05:02 (5 hours ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (944/60 min)'; Requests=944	Port Scan
🇩🇪 ghostwarriors	2026-10-17 09:20:05 (6 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-10-17 09:11:53 (6 hours ago)	100.54.217.213 - - [17/Oct/2026:11:11:46 +0200] "GET /inputs.php HTTP/1.1" 301 544 "http://officegun ... show more 100.54.217.213 - - [17/Oct/2026:11:11:46 +0200] "GET /inputs.php HTTP/1.1" 301 544 "http://officeguns.net/inputs.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:11:11:49 +0200] "GET /inputs.php HTTP/2.0" 404 332 "http://[site]/inputs.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:11:11:49 +0200] "GET /classsmtps.php HTTP/1.1" 301 552 "http://officeguns.net/classsmtps.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:11:11:50 +0200] "GET /classsmtps.php HTTP/2.0" 404 78 "http://[site]/classsmtps.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 100.54.217.213 - - [17/Oct/2026:11:11:50 +0200] "GET /wp-blog-header.php show less	Web App Attack Hacking
🇫🇷 AGEPCom	2026-10-17 06:36:50 (8 hours ago)	Smart-Ban: IP bannie via score AbuseIPDB	Brute-Force Web App Attack
🇺🇸 Mundo Bueno	2026-10-17 06:07:05 (9 hours ago)	[ISILIA Protection v2.3] Tentative d'accès: /info.php [RATE LIMITED - 1800s quarantine] \| Pays: US \| ... show more [ISILIA Protection v2.3] Tentative d'accès: /info.php [RATE LIMITED - 1800s quarantine] \| Pays: US \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Sa show less	Hacking Web App Attack
🇺🇸 Hazael	2026-10-17 05:53:41 (9 hours ago)	SNOOPING - intended to probe for or exploit website vulnerabilities. From: Ashburn, USA - Amazon.com ... show more SNOOPING - intended to probe for or exploit website vulnerabilities. From: Ashburn, USA - Amazon.com, Inc. (AS14618 Amazon.com, Inc.) - Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 04:51:21 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 100.54.217.213 (ec2-100-54-217-213.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 100.54.217.213 (ec2-100-54-217-213.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:51:13.950751 2026] [security2:error] [pid 19868:tid 19868] [client 100.54.217.213:51143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wearywillie.com"] [uri "/wp-config.php"] [unique_id "atL-wcXBHE5dja6-AY72cQAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-10-17 04:35:51 (10 hours ago)	Excessive 404/403 errors	Brute-Force

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.176.31.249

🇨🇳 112.51.5.102

🇳🇱 77.239.124.102

🇬🇧 193.163.125.251

🇲🇽 177.227.77.171

🇺🇸 51.8.102.157

🇰🇷 211.104.198.147

🇧🇷 177.20.165.170

🇦🇷 170.246.181.5

🇷🇺 109.63.145.141

🇺🇸 45.79.172.21

🇺🇸 20.169.85.79

🇷🇴 2.57.121.112

🇸🇪 104.23.217.86

🇳🇱 103.214.5.133

🇱🇰 61.245.170.180

🇲🇾 47.250.37.179

🇮🇩 103.241.205.82

🇺🇸 74.235.108.235

🇳🇱 45.148.10.240