JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.54.190.221

159.54.190.221 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 46%: ?

46%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.54.190.221

Whois 159.54.190.221

IP Abuse Reports for 159.54.190.221:

This IP address has been reported a total of 28 times from 18 distinct sources. 159.54.190.221 was first reported on August 17th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-26 22:03:23 (3 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-25. show less	Web App Attack SSH Hacking
🇺🇸 mnsf	2026-06-25 21:30:38 (4 days ago)	Abuse Detected (1)	Brute-Force Web App Attack
Anonymous	2026-06-25 18:07:09 (4 days ago)	Automated web scanner. Requested suspicious paths: /.envrc. UTC: 2026-06-25 17:22:36.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 17:54:45 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 13:54:39.533626 2026] [security2:error] [pid 25046:tid 25046] [client 159.54.190.221:39818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cpking.com"] [uri "/.env.production"] [unique_id "aj1rX4Ill9Dxu_AMR_6BlAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 16:16:50 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 12:16:33.454502 2026] [security2:error] [pid 10821:tid 10821] [client 159.54.190.221:38708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mariarozella.com"] [uri "/.env.local"] [unique_id "aj1UYXsNc9zVd36m3QbHeAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-06-25 15:43:14 (4 days ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env.production	Web App Attack
🇺🇦 Olexiy Backend	2026-06-25 14:23:15 (5 days ago)	159.54.190.221 ...	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 14:21:40 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 10:21:33.527134 2026] [security2:error] [pid 18571:tid 18571] [client 159.54.190.221:58832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americancryonics.org"] [uri "/.env.production"] [unique_id "aj05bVts1AJclSbl1brQSQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 08:26:13 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 159.54.190.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 04:26:02.294234 2026] [security2:error] [pid 30906:tid 30906] [client 159.54.190.221:58756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.vespaitaliancafe.com"] [uri "/backend/.env"] [unique_id "ajzmGsbW7lFCTg6RVtO3LwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-06-25 07:43:02 (5 days ago)	Try to access /.env	Web App Attack
🇫🇷 MatStef132	2026-06-12 22:47:21 (2 weeks ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇫🇷 MatStef132	2026-05-21 15:51:22 (1 month ago)	MatShield L7: blocked on mathost.eu (ua-quarantined)	Bad Web Bot
🇷🇴 Fn4ticHz	2026-05-10 11:58:03 (1 month ago)	Repeated DDoS targeted -- ZeroGuard X ManagedSRV	DDoS Attack Exploited Host
🇮🇹 VHosting	2026-04-26 13:12:11 (2 months ago)	Detected attack and reported by a human	Brute-Force Web App Attack SSH DDoS Attack Exploited Host Bad Web Bot
🇳🇱 Savvii	2026-02-10 18:20:09 (4 months ago)	20 attempts against mh-misbehave-ban on moon	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 204.76.203.80

🇨🇳 180.139.57.76

🇨🇳 113.67.8.114

🇮🇳 103.116.137.114

🇷🇴 94.156.152.50

🇫🇮 77.105.161.120

🇳🇱 45.156.128.174

🇺🇸 43.166.242.149

🇨🇳 219.156.80.231

🇮🇶 185.24.60.6

🇮🇳 182.78.240.94

🇺🇸 162.216.149.209

🇺🇸 158.94.187.77

🇺🇸 104.152.52.139

🇦🇺 101.188.53.199

🇨🇳 101.96.195.17

🇩🇪 95.85.252.34

🇳🇱 91.92.40.36

🇳🇱 45.148.10.147

🇧🇷 20.226.81.217