JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

54.160.129.195

Neutral Activity

Abuse Confidence Score

0% Low Risk

33 reports

20 reporters · latest 1 year ago

ISP: Amazon Technologies Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14618
Hostname(s): ec2-54-160-129-195.compute-1.amazonaws.com
Domain Name: amazon.com
Country: 🇺🇸 United States of America
City: Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

54.160.129.195 has been reported 33 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

33 from 20 distinct reporters

First reported

September 30th 2025

Most recent report

1 year ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Swiptly	2025-09-30 15:51:53 UTC · (1 year ago)	Bot scanning for environment files .env .env/\* ...	Web App Attack
🇮🇹 Progetto1	2025-09-30 15:49:02 UTC · (1 year ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
Anonymous	2025-09-30 15:34:04 UTC · (1 year ago)	54.160.129.195 - sliver85.eu - [30/Sep/2025:17:34:03 +0200] "GET /.env HTTP/1.1" 444 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" 54.160.129.195 - sliver85.eu - [30/Sep/2025:17:34:0 ... show more 54.160.129.195 - sliver85.eu - [30/Sep/2025:17:34:03 +0200] "GET /.env HTTP/1.1" 444 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" 54.160.129.195 - sliver85.eu - [30/Sep/2025:17:34:03 +0200] "GET /.env HTTP/1.1" 444 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 15:33:08 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 11:33:05.197379 2025] [security2:error] [pid 26173 ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 11:33:05.197379 2025] [security2:error] [pid 26173:tid 26173] [client 54.160.129.195:39694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "skintormint.com"] [uri "/.env"] [unique_id "aNv4MRSZcbyTyL87Iop4-wAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇰 SaltySoftworks	2025-09-30 15:12:03 UTC · (1 year ago)	by Amazon Technologies Inc.	DDoS Attack Web Spam Hacking Bad Web Bot Web App Attack
🇫🇷 ingroscart.it	2025-09-30 15:04:27 UTC · (1 year ago)	(mod_security) mod_security triggered on hostname [redacted] 54.160.129.195 (US/United States/ec2-54-160-129-195.compute-1.amazonaws.com)	SQL Injection
🇺🇸 TPI-Abuse	2025-09-30 14:57:24 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 10:57:19.506017 2025] [security2:error] [pid 14411 ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 10:57:19.506017 2025] [security2:error] [pid 14411:tid 14411] [client 54.160.129.195:49182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "renju.net"] [uri "/.env"] [unique_id "aNvvz3zBqymwkYaHskZwdgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 14:38:11 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 10:38:06.400139 2025] [security2:error] [pid 12674 ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 10:38:06.400139 2025] [security2:error] [pid 12674:tid 12674] [client 54.160.129.195:33128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pist.org.tr"] [uri "/.env"] [unique_id "aNvrToirc3aVtQZ7G2mTKAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Rip	2025-09-30 14:29:19 UTC · (1 year ago)	Automated recon attempt targeting restricted and sensitive paths.	Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 13:50:40 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:50:33.360159 2025] [security2:error] [pid 7065: ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:50:33.360159 2025] [security2:error] [pid 7065:tid 7077] [client 54.160.129.195:55896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "metropolitanbasel.org"] [uri "/.env"] [unique_id "aNvgKfbVhAeT4SEy6w0JfAAAAIk"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 kumiko	2025-09-30 13:34:10 UTC · (1 year ago)	[2025-09-30 16:34:09] Probing for dotfiles "GET /.env HTTP/1.1" 403	Bad Web Bot Web App Attack
🇺🇸 lnklnx	2025-09-30 13:30:30 UTC · (1 year ago)	www.lnklnx.com:443 54.160.129.195 - - [30/Sep/2025:08:30:28 -0500] "GET /.env HTTP/1.1" 403 3793 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ...	Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 13:22:12 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:22:09.536907 2025] [security2:error] [pid 25641 ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:22:09.536907 2025] [security2:error] [pid 25641:tid 25641] [client 54.160.129.195:50638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lcssouth.com"] [uri "/.env"] [unique_id "aNvZgaHjTtqrzY4XEBh6EwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 13:05:43 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:05:37.808417 2025] [security2:error] [pid 777:t ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 09:05:37.808417 2025] [security2:error] [pid 777:tid 777] [client 54.160.129.195:34164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "k0cgy.net"] [uri "/.env"] [unique_id "aNvVof8F_AhHBor6snIGbwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-30 12:33:58 UTC · (1 year ago)	(mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 08:33:54.357882 2025] [security2:error] [pid 3753: ... show more (mod_security) mod_security (id:210492) triggered by 54.160.129.195 (ec2-54-160-129-195.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 08:33:54.357882 2025] [security2:error] [pid 3753:tid 3753] [client 54.160.129.195:36484] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "handankoc.net"] [uri "/.env"] [unique_id "aNvOMsOuCnT2tynuJ2zmdAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 33 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇧🇴 158.172.227.91

🇺🇸 170.9.250.207

🇫🇮 157.22.126.96

🇻🇪 143.255.86.122

🇹🇭 125.24.94.75

🇺🇸 94.154.127.133

🇳🇱 45.148.10.152

🇷🇺 5.139.225.170

🇳🇱 195.178.110.217

🇨🇴 181.55.101.98

🇸🇬 159.89.207.222

🇺🇿 94.158.58.244

🇧🇬 79.124.58.106

🇳🇱 45.148.10.157

🇧🇷 20.201.77.247

🇺🇸 193.37.252.71

🇰🇷 175.213.102.205

🇺🇸 172.58.244.244

🇨🇴 170.78.43.36

🇵🇰 153.117.127.221