JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 134.199.218.54

134.199.218.54 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇺🇸 United States of America
City	Santa Clara, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 134.199.218.54

Whois 134.199.218.54

IP Abuse Reports for 134.199.218.54:

This IP address has been reported a total of 68 times from 58 distinct sources. 134.199.218.54 was first reported on September 25th 2025, and the most recent report was 29 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ut-addicted.com	2026-09-02 16:20:38 (29 minutes ago)	\[Wed Sep 02 18:20:37.031839 2026\] \[:error\] \[pid 28042:tid 140352619017984\] \[client 134.199.21 ... show more \[Wed Sep 02 18:20:37.031839 2026\] \[:error\] \[pid 28042:tid 140352619017984\] \[client 134.199.218.54:35442\] \[client 134.199.218.54\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "www.crx.it"\] \[uri "/"\] \[unique_id "aphM1EyGSoo-ZL59Um18LQAAAME"\], referer: https://www.crx.it/ show less	Brute-Force Web App Attack
🇵🇱 tomkolp	2026-09-02 16:01:20 (49 minutes ago)	CrowdSec - Scenario: LePresidente/http-generic-403-bf. Duration: 4h.	Web App Attack Hacking
🇺🇸 Charlesiv	2026-09-02 16:01:03 (49 minutes ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE ASN: 14061 (Digit ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: MANAGED_CHALLENGE ASN: 14061 (DigitalOcean, LLC) Protocol: HTTP/1.1 (POST method) Endpoint: / Timestamp: 2026-09-02T12:24:25Z Ray ID: a34c7dd51fcfe8d8 UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 show less	Bad Web Bot
🇨🇿 ddw	2026-09-02 15:56:43 (53 minutes ago)	ModSecurity detection - Rules: 920450(HTTP header is restricted by policy (/content-encoding/)), 200 ... show more ModSecurity detection - Rules: 920450(HTTP header is restricted by policy (/content-encoding/)), 200002(Failed to parse request body.) show less	Web App Attack
🇺🇸 Starburst SysOp Team	2026-09-02 15:28:21 (1 hour ago)	HTTP header is restricted by policy (/content-encoding/). String match within "/content-encoding/ /p ... show more HTTP header is restricted by policy (/content-encoding/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_content-encoding. (920450-mnz6-7) show less	Bad Web Bot
🇦🇺 Bay13	2026-09-02 15:28:16 (1 hour ago)	CrowdSec:custom/modsecurity	Web App Attack
🇺🇸 jcbriar	2026-09-02 15:23:44 (1 hour ago)	CSRF or other malfeasance	Hacking Web App Attack
🇫🇮 23p02732	2026-09-02 15:19:46 (1 hour ago)	Mailserver and mailaccount attacks	Brute-Force Bad Web Bot Exploited Host Web App Attack
🇺🇸 xxkodedxx	2026-09-02 15:07:31 (1 hour ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: US / AS14061 DigitalOcean, LLC Active: 15:07:29 UTC Volume: 1 HTTP req Probed: / Status mix: 444×1 Vhost fishing: secondopinion.ztx-lab.com UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇹🇷 sgonul71	2026-09-02 14:46:33 (2 hours ago)	Web app attacks (IIS logs)	Web App Attack
🇵🇱 Woytass	2026-09-02 14:39:57 (2 hours ago)	CSF/lfd permanent block on srv1.woytas.ovh. Trigger=LF_MODSEC; ports=; (mod_security) mod_security ... show more CSF/lfd permanent block on srv1.woytas.ovh. Trigger=LF_MODSEC; ports=; (mod_security) mod_security (id:949110) triggered by 134.199.218.54 (US/United States/-): 5 in the last 3600 secs show less	Web App Attack
🇩🇪 FeG Deutschland	2026-09-02 14:26:45 (2 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27	Exploited Host Web App Attack
🇫🇮 as211431.net	2026-09-02 14:25:18 (2 hours ago)	Triggered Cloudflare WAF (linkMaze) from US. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (PO ... show more Triggered Cloudflare WAF (linkMaze) from US. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2026-09-02 14:19:05 (2 hours ago)	[Wed Sep 02 16:19:03.817913 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH0 ... show more [Wed Sep 02 16:19:03.817913 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH01630: client denied by server configuration: /var/www/html/default/, referer: https://narrowblast-usercontent.amo.rocks/ [Wed Sep 02 16:19:03.992926 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH01630: client denied by server configuration: /var/www/html/default/, referer: https://narrowblast-usercontent.amo.rocks/ [Wed Sep 02 16:19:04.211154 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH01630: client denied by server configuration: /var/www/html/default/, referer: https://narrowblast-usercontent.amo.rocks/ [Wed Sep 02 16:19:04.425199 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH01630: client denied by server configuration: /var/www/html/default/, referer: https://narrowblast-usercontent.amo.rocks/ [Wed Sep 02 16:19:04.677754 2026] [authz_core:error] [pid 1698237] [client 134.199.218.54:19890] AH01630: client den ... show less	Web App Attack
🇫🇷 GoodOldTOS	2026-09-02 14:18:21 (2 hours ago)	Highly suspect IP	Hacking Web App Attack

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 193.163.125.42

🇧🇷 189.7.87.155

🇺🇸 154.223.17.178

🇧🇷 138.36.215.108

🇹🇭 118.194.250.31

🇨🇳 106.75.190.150

🇬🇧 85.203.36.185

🇷🇴 80.94.92.234

🇺🇸 66.132.186.167

🇨🇳 2409:8720:1800:3b::2:78

🇲🇽 189.190.217.141

🇲🇽 187.187.192.206

🇳🇱 185.223.235.28

🇨🇳 124.167.20.72

🇨🇳 106.124.44.229

🇨🇳 42.51.49.166

🇳🇱 34.141.145.118

🇺🇸 3.132.94.157

🇷🇴 2.57.122.238

🇦🇷 186.5.180.174