JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.54.37.129

52.54.37.129 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 14%: ?

14%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-52-54-37-129.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.54.37.129

Whois 52.54.37.129

IP Abuse Reports for 52.54.37.129:

This IP address has been reported a total of 24 times from 11 distinct sources. 52.54.37.129 was first reported on January 22nd 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇮 as211431.net	2026-06-11 13:58:38 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST meth ... show more Triggered Cloudflare WAF (firewallCustom) from US. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 masterguru	2026-06-11 12:46:36 (1 month ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.54.37.129 (US/United States/ec2-52 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇸🇬 securejdprop	2026-06-01 02:48:14 (1 month ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ATTACK [PTsecurity ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ATTACK [PTsecurity] React Server Components RCE (CVE-2025-55182)). Ip 52.54.37.129 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-06-01 02:48:13.35072103 +0000 UTC show less	Hacking Web App Attack
🇱🇻 garmtech.com	2026-05-31 17:21:40 (1 month ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
🇫🇷 masterguru	2026-05-27 13:16:26 (1 month ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.54.37.129 (US/United States/ec2-52 ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 1 in the last 3600 secs (0-195) show less	Hacking
🇮🇩 Burayot	2026-03-22 08:37:45 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2- ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 1 in the last 3600 secs show less	Web App Attack
🇮🇩 Paulus Leunufna	2026-03-22 08:10:38 (4 months ago)	Fail2Ban auto-ban: Security Violation detected. Jail: ghost-protocol, Attempts: 1. Server: LumaChat ... show more Fail2Ban auto-ban: Security Violation detected. Jail: ghost-protocol, Attempts: 1. Server: LumaChat (lumachat.xyz) show less	Brute-Force
🇮🇩 Burayot	2026-03-21 23:49:04 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2- ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 zam	2026-03-21 00:14:08 (4 months ago)	52.54.37.129 - - [21/Mar/2026:00:14:02 +0000] "GET /a1b2c3d4e5f6-not-found HTTP/1.1" 404 82108 52.54 ... show more 52.54.37.129 - - [21/Mar/2026:00:14:02 +0000] "GET /a1b2c3d4e5f6-not-found HTTP/1.1" 404 82108 52.54.37.129 - - [21/Mar/2026:00:14:03 +0000] "GET /_ignition/health-check HTTP/1.1" 404 82108 52.54.37.129 - - [21/Mar/2026:00:14:03 +0000] "GET /_debugbar/open HTTP/1.1" 404 82108 52.54.37.129 - - [21/Mar/2026:00:14:03 +0000] "GET /telescope HTTP/1.1" 404 82108 52.54.37.129 - - [21/Mar/2026:00:14:04 +0000] "GET /sftp-config.json HTTP/1.1" 404 82108 {"log":"52.54.37.129 - - [21/Mar/2026:00:14:04 +0000] "GET /.vscode/sftp.json show less	Web App Attack
🇮🇩 Burayot	2026-03-20 17:43:28 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2- ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 2 in the last 3600 secs show less	Web App Attack
🇮🇩 Burayot	2026-03-20 14:49:07 (4 months ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2- ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.54.37.129 (US/United States/ec2-52-54-37-129.compute-1.amazonaws.com): 1 in the last 3600 secs show less	Web App Attack
🇮🇩 sockominfo	2026-03-19 13:00:31 (4 months ago)	Access to sensitive files detected w/ specific boundary., Suspicious URL access., Access to sensitiv ... show more Access to sensitive files detected w/ specific boundary., Suspicious URL access., Access to sensitive configuration files detected.. Threat Score: 5.1/10 (MEDIUM). Confidence: 55%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 80%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Stale. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-03-19 09:01:08 (4 months ago)	Access to sensitive files detected w/ specific boundary., Suspicious URL access., Access to sensitiv ... show more Access to sensitive files detected w/ specific boundary., Suspicious URL access., Access to sensitive configuration files detected.. Threat Score: 5.3/10 (MEDIUM). Confidence: 55%. CVSS v3.1: 2.9/10 (Low). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Bayesian Probability: 80%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Moderate. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-03-19 08:00:56 (4 months ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 6.8/10 (MEDIUM). Reported by ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 6.8/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-03-19 07:00:57 (4 months ago)	Access to sensitive files detected w/ specific boundary.. Threat Score: 6.9/10 (MEDIUM). Reported by ... show more Access to sensitive files detected w/ specific boundary.. Threat Score: 6.9/10 (MEDIUM). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 195.182.16.23

🇸🇪 170.168.243.112

🇬🇧 148.252.144.185

🇧🇬 92.247.47.202

🇷🇴 92.118.39.50

🇳🇱 91.92.42.81

🇿🇦 66.8.6.150

🇺🇸 54.214.113.121

🇻🇳 42.96.20.16

🇺🇸 20.168.0.46

🇺🇸 174.140.218.203

🇺🇸 172.252.129.136

🇸🇬 172.217.97.18

🇳🇱 172.71.183.105

🇨🇳 122.114.35.55

🇨🇦 99.241.94.234

🇳🇱 64.89.162.146

🇳🇱 45.148.10.141

🇮🇪 34.247.216.127

🇺🇸 20.15.225.72