JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.54.107.63

52.54.107.63 was found in our database!

This IP was reported 147 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-52-54-107-63.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.54.107.63

Whois 52.54.107.63

IP Abuse Reports for 52.54.107.63:

This IP address has been reported a total of 147 times from 106 distinct sources. 52.54.107.63 was first reported on June 2nd 2026, and the most recent report was 32 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 oh.mg	2026-06-03 21:58:48 (8 hours ago)	[Wed Jun 03 23:58:47.595823 2026] [security2:error] [pid 1007370:tid 1007382] [client 52.54.107.63:6 ... show more [Wed Jun 03 23:58:47.595823 2026] [security2:error] [pid 1007370:tid 1007382] [client 52.54.107.63:64438] [client 52.54.107.63] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 60)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mmn.on.ca"] [uri "/"] [unique_id "aiCjl75ighqyfel9O3vMFQAAAAo"], referer: https://mmn.on.ca/ ... show less	Web App Attack Bad Web Bot
🇨🇿 ddw	2026-06-03 21:42:41 (8 hours ago)	ModSecurity detection - Rules: 949110(Inbound Anomaly Score Exceeded (Total Score: 60))	Web App Attack
Anonymous	2026-06-03 21:15:54 (8 hours ago)	Web Attack React Server Components Remote Code Execution Vulnerability	Web App Attack
🇫🇮 mnazibo	2026-06-03 20:15:17 (9 hours ago)	Date: Jun 03 23:03:10 2026 EAT \| Reported IP: 52.54.107.63 mod_security \| id: 933160 934100 934130 9 ... show more Date: Jun 03 23:03:10 2026 EAT \| Reported IP: 52.54.107.63 mod_security \| id: 933160 934100 934130 942550 949110 200002 920450 \| US/usernameab.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| Logs: ; PHP Injection Attack: High-Risk PHP Function Call Found; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; Node.js Injection Attack 1/2; JavaScript Prototype Pollution; JavaScript Prototype Pollution; JavaScript Prototype Pollution; JSON-Based SQL Injection; Inbound Anomaly Score Exceeded (Total Score: 45); Failed to parse request body.; HTTP header is restricted by policy (/content-encoding/) show less	SQL Injection Brute-Force Bad Web Bot
🇺🇸 Shouddy Tarano	2026-06-03 19:24:38 (10 hours ago)	[Wed Jun 03 13:24:37.771255 2026] [authz_core:error] [pid 2026729:tid 139792410973952] [client 52.54 ... show more [Wed Jun 03 13:24:37.771255 2026] [authz_core:error] [pid 2026729:tid 139792410973952] [client 52.54.107.63:30754] AH01630: client denied by server configuration: /var/www/api-erpcampestre/api-erpcampestre/public/, referer: https://erpapi.campestremty.com/ [Wed Jun 03 13:24:37.777266 2026] [authz_core:error] [pid 2026729:tid 139792410973952] [client 52.54.107.63:30754] AH01630: client denied by server configuration: /usr/share/httpd/noindex/index.html, referer: https://erpapi.campestremty.com/ [Wed Jun 03 13:24:37.850108 2026] [authz_core:error] [pid 2026729:tid 139792293476096] [client 52.54.107.63:30754] AH01630: client denied by server configuration: /var/www/api-erpcampestre/api-erpcampestre/public/, referer: https://erpapi.campestremty.com/ [Wed Jun 03 13:24:37.856765 2026] [authz_core:error] [pid 2026729:tid 139792293476096] [client 52.54.107.63:30754] AH01630: client denied by server configuration: /usr/share/httpd/noindex/index.html, referer: https://erpapi.campestremty.com/ [W ... show less	DDoS Attack Web Spam Brute-Force Web App Attack
🇨🇭 Ribeye375	2026-06-03 19:16:10 (10 hours ago)	HIPS nginx-anti-botnet - Block tcp/0:65535	Bad Web Bot
🇩🇰 ScamAware	2026-06-03 19:09:20 (10 hours ago)	Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot ... show more Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 5. Unique request paths counted internally: 1. Cloudflare action: managed_challenge. Cloudflare source: botFight. show less	Bad Web Bot
🇧🇪 Saec	2026-06-03 19:00:06 (11 hours ago)	Jarvis auto-ban: CF top attacker on saec.me (27 hits, US)	Port Scan Web App Attack
Anonymous	2026-06-03 18:45:06 (11 hours ago)	Automatic report - Vulnerability scan /	Web App Attack
🇩🇪 IVski	2026-06-03 18:43:36 (11 hours ago)	IVski WAF \| Multiple 403 Forbidden responses detected from this IP. Likely automated scanning.	DDoS Attack Bad Web Bot
🇮🇹 eliosbrocchi	2026-06-03 18:39:14 (11 hours ago)	[Wed Jun 03 20:39:13.288223 2026] [access_compat:error] [pid 974606:tid 974648] [client 52.54.107.63 ... show more [Wed Jun 03 20:39:13.288223 2026] [access_compat:error] [pid 974606:tid 974648] [client 52.54.107.63:52748] AH01797: client denied by server configuration: /var/www/public_static/contestazioni.crislio.com/, referer: https://contestazioni.crislio.com/ [Wed Jun 03 20:39:13.410711 2026] [access_compat:error] [pid 974606:tid 974641] [client 52.54.107.63:52748] AH01797: client denied by server configuration: /var/www/public_static/contestazioni.crislio.com/, referer: https://contestazioni.crislio.com/ [Wed Jun 03 20:39:13.527725 2026] [access_compat:error] [pid 974606:tid 974650] [client 52.54.107.63:52748] AH01797: client denied by server configuration: /var/www/public_static/contestazioni.crislio.com/, referer: https://contestazioni.crislio.com/ ... show less	VPN IP
🇺🇸 LotPhantom	2026-06-03 18:12:27 (11 hours ago)	52.54.107.63 - - [03/Jun/2026:18:11:53 +0000] "POST / HTTP/1.1" 404 683 "https://buildinguate.bridgi ... show more 52.54.107.63 - - [03/Jun/2026:18:11:53 +0000] "POST / HTTP/1.1" 404 683 "https://buildinguate.bridginggaps.tech/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "0" ... show less	Web App Attack
🇨🇭 dalslab ltd	2026-06-03 17:39:33 (12 hours ago)	[03/Jun/2026:19:39:32 +0200] - 403 403 - POST https auth.dalslab.com "/" [Client 52.54.107.63] [Leng ... show more [03/Jun/2026:19:39:32 +0200] - 403 403 - POST https auth.dalslab.com "/" [Client 52.54.107.63] [Length 748] [Gzip -] [Sent-to 10.1.1.240] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" "https://auth.dalslab.com/" [03/Jun/2026:19:39:32 +0200] - 403 403 - POST https auth.dalslab.com "/" [Client 52.54.107.63] [Length 748] [Gzip -] [Sent-to 10.1.1.240] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "https://auth.dalslab.com/" [03/Jun/2026:19:39:33 +0200] - 403 403 - POST https auth.dalslab.com "/" [Client 52.54.107.63] [Length 748] [Gzip -] [Sent-to 10.1.1.240] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" "https://auth.dalslab.com/" [03/Jun/2026:19:39:33 +0200] - 403 403 - POST https auth.dalslab.com "/" [Client 52.54.107.63] [Length 748] [Gzip -] [Sent-to 10.1.1.240] "Mozilla/5.0 (Wi ... show less	Web Spam Brute-Force Bad Web Bot Web App Attack
🇳🇱 ReyhZhao	2026-06-03 17:16:43 (12 hours ago)	Bunkerweb ModSecurity alert: Access denied (403) due to an inbound anomaly score exceeding the allow ... show more Bunkerweb ModSecurity alert: Access denied (403) due to an inbound anomaly score exceeding the allowed threshold, triggering the OWASP Core Rule Set blocking evaluation. show less	Brute-Force
Anonymous	2026-06-03 17:02:29 (13 hours ago)	52.54.107.63 - - [04/Jun/2026:02:02:28 +0900] "POST / HTTP/1.1" 403 3074 "https://admin.lifeway.jp/" ... show more 52.54.107.63 - - [04/Jun/2026:02:02:28 +0900] "POST / HTTP/1.1" 403 3074 "https://admin.lifeway.jp/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 52.54.107.63 - - [04/Jun/2026:02:02:28 +0900] "POST / HTTP/1.1" 403 465 "https://admin.lifeway.jp/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" 52.54.107.63 - - [04/Jun/2026:02:02:28 +0900] "POST / HTTP/1.1" 403 465 "https://admin.lifeway.jp/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" 52.54.107.63 - - [04/Jun/2026:02:02:28 +0900] "POST / HTTP/1.1" 403 465 "https://admin.lifeway.jp/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" 52.54.107.63 - - [04/Jun/2026:02:02:29 +0900] "POST / HTTP/1.1" 403 520 "https://admin.lifeway.jp/" "Mozilla/5.0 (Windows NT 10.0; Win64; ... show less	Brute-Force

Showing 16 to 30 of 147 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2804:3004:8002:9ed:cd38:cd46:4c81:b2e4

🇺🇸 206.221.176.152

🇹🇼 198.235.24.78

🇹🇼 198.235.24.77

🇩🇪 193.169.194.14

🇨🇳 115.212.108.15

🇩🇪 87.106.47.28

🇺🇸 66.132.172.216

🇸🇻 45.167.3.39

🇺🇸 43.135.133.194

🇹🇼 198.235.24.110

🇹🇼 198.235.24.65

🇹🇼 198.235.24.48

🇺🇸 195.184.76.104

🇲🇾 121.123.141.251

🇸🇬 107.155.55.85

🇺🇸 76.170.227.154

🇵🇭 49.149.96.169

🇨🇳 36.20.99.166

🇹🇼 198.235.24.42