JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.160.156.250

54.160.156.250 was found in our database!

This IP was reported 68 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-160-156-250.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.160.156.250

Whois 54.160.156.250

IP Abuse Reports for 54.160.156.250:

This IP address has been reported a total of 68 times from 64 distinct sources. 54.160.156.250 was first reported on September 14th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-09-15 06:00:01 (2 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇸🇮 administrator	2026-09-14 22:01:54 (3 days ago)	2026-09-14 12:16:36,446 fail2ban.actions [1164]: NOTICE [apache-botsearch] Ban 54.160.156.25 ... show more 2026-09-14 12:16:36,446 fail2ban.actions [1164]: NOTICE [apache-botsearch] Ban 54.160.156.250 2026-09-14 12:16:36,448 fail2ban.actions [1164]: NOTICE [apache-auth] Ban 54.160.156.250 2026-09-14 12:16:36,446 fail2ban.actions [1164]: NOTICE [apache-botsearch] Ban 54.160.156.250 ... show less	Bad Web Bot Web Spam Email Spam Blog Spam Port Scan Brute-Force Web App Attack
🇺🇸 Awack	2026-09-14 16:59:46 (3 days ago)	Automated secrets/config-file dictionary scanner (335 requests in ~24h): composer.json, cloud-config ... show more Automated secrets/config-file dictionary scanner (335 requests in ~24h): composer.json, cloud-config.yml, .codeclimate.yml, collibra.properties, config/initializers/secret_token.rb, etc. Also tripped ModSecurity CRS 251x (SQLi, backup-file access, security-scanner UA). show less	Bad Web Bot Web App Attack
🇺🇸 dot.mg	2026-09-14 16:00:04 (3 days ago)	Bad behaviour	Web Spam
🇪🇸 pepitogrillo	2026-09-14 15:53:42 (3 days ago)	[Mon Sep 14 15:53:40.859298 2026] [access_compat:error] [pid 687961] [client 54.160.156.250:49578] A ... show more [Mon Sep 14 15:53:40.859298 2026] [access_compat:error] [pid 687961] [client 54.160.156.250:49578] AH01797: client denied by server configuration: /var/www/html/nextcloud/config/configuration.yml [Mon Sep 14 15:53:40.860018 2026] [access_compat:error] [pid 687727] [client 54.160.156.250:49570] AH01797: client denied by server configuration: /var/www/html/nextcloud/config/development.sphinx.conf [Mon Sep 14 15:53:40.873095 2026] [access_compat:error] [pid 687877] [client 54.160.156.250:49592] AH01797: client denied by server configuration: /var/www/html/nextcloud/config/initializers ... show less	DNS Compromise DNS Poisoning Fraud Orders DDoS Attack Ping of Death Phishing Fraud VoIP Open Proxy Web Spam Email Spam Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack IoT Targeted
🇫🇷 dynamix	2026-09-14 15:48:47 (3 days ago)	Multiple WAF Violations	Web App Attack
🇷🇴 iulianh	2026-09-14 15:34:20 (3 days ago)	80,443	Brute-Force SSH
🇫🇷 ecode hosting	2026-09-14 15:06:04 (3 days ago)	Domain : ermedmedical.com Rule : hack 2026-09-14 15:03:43 10.100.1.20 GET /data.bak - 443 - 54.160.1 ... show more Domain : ermedmedical.com Rule : hack 2026-09-14 15:03:43 10.100.1.20 GET /data.bak - 443 - 54.160.156.250 HTTP/2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 - ermedmedical.com 404 0 2 103 195 144 - - show less	Hacking SQL Injection Brute-Force
🇬🇧 Smish	2026-09-14 15:01:38 (3 days ago)	HONEYPOT HIT --> Fail2ban time=1789398097 log=2026-09-14T16:01:37+01:00 ip=54.160.156.250 host=route ... show more HONEYPOT HIT --> Fail2ban time=1789398097 log=2026-09-14T16:01:37+01:00 ip=54.160.156.250 host=router.ham.as210667.net method=GET uri="/bitrix/modules/updater.log" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ref="-" rid=2dab99cdff0ab5812fc01fa0bde9c9cc show less	Web App Attack
🇵🇱 gandaflux	2026-09-14 15:01:30 (3 days ago)	54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /app/collibra.properties HTTP/2 ... show more 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /app/collibra.properties HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /api/postman.json HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /ansible.cfg HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /admin_dev.php HTTP/2.0" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /api/frontend/settings HTTP/2.0" 404 25488 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 [redacted-domain] - [14/Sep/2026:17:01:27 +0200] "GET /api/v1/statu show less	Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-14 14:55:11 (3 days ago)	URL file extension is restricted by policy. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ ... show more URL file extension is restricted by policy. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. (920440-135) show less	Hacking
Anonymous	2026-09-14 14:39:36 (3 days ago)	54.160.156.250 - - [14/Sep/2026:14:39:31 +0000] "GET /cgi-bin/info.cgi HTTP/1.1" 404 146 "-" "Mozill ... show more 54.160.156.250 - - [14/Sep/2026:14:39:31 +0000] "GET /cgi-bin/info.cgi HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" 54.160.156.250 - - [14/Sep/2026:14:39:31 +0000] "GET /cgi-bin/printenv.pl HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-" ... show less	Port Scan Hacking Bad Web Bot
🇩🇪 hbrks	2026-09-14 14:37:04 (3 days ago)	200 attack(s) detected, such as these: {"event":"web_block","ip":"54.160.156.250","host":"go.marche- ... show more 200 attack(s) detected, such as these: {"event":"web_block","ip":"54.160.156.250","host":"go.marche-be.com","request":"GET /wwwroot.bak HTTP/2.0","user_agent":"","reason":"Status-404","timestamp":"2026-09-14T14:37:04 00:00","logentry":"go.marche-be.com 54.160.156.250 - - [14/Sep/2026:14:37:04 0000] \"GET /wwwroot.bak HTTP/2.0\" 404 153 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\" \"-\""} * Report Details : https://p4u.xyz/OQ9WG2QLT4L/1 IP Details *: https://p4u.xyz/OQ9WG2QLT4L/2 show less	Web Spam Hacking Bad Web Bot
Anonymous	2026-09-14 14:14:45 (3 days ago)	54.160.156.250 - - [14/Sep/2026:09:07:35 -0500] "GET /bitrix/modules/updater.log HTTP/2.0" 301 265 " ... show more 54.160.156.250 - - [14/Sep/2026:09:07:35 -0500] "GET /bitrix/modules/updater.log HTTP/2.0" 301 265 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 - - [14/Sep/2026:09:07:35 -0500] "GET /bitrix/modules/updater_partner.log HTTP/2.0" 301 273 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 54.160.156.250 - - [14/Sep/2026:09:14:43 -0500] "GET /bitrix/modules/updater.log HTTP/2.0" 301 259 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Brute-Force Web App Attack
🇬🇧 thetomtaylor.co.uk	2026-09-14 14:08:01 (3 days ago)	Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice02,wa01]	Hacking SQL Injection Web App Attack

Showing 1 to 15 of 68 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.73.163.67

🇺🇸 209.227.61.130

🇺🇸 204.8.96.104

🇧🇩 202.44.104.39

🇩🇪 195.182.16.23

🇮🇳 182.71.75.106

🇭🇰 110.4.14.111

🇨🇳 106.75.153.142

🇮🇩 103.193.166.12

🇫🇷 91.196.152.107

🇩🇪 91.108.194.174

🇬🇧 89.19.48.223

🇩🇪 84.55.2.88

🇺🇿 84.54.71.145

🇧🇬 78.128.113.46

🇺🇸 64.62.197.15

🇻🇳 42.1.65.89

🇩🇪 213.209.140.233

🇺🇸 206.81.1.60

🇧🇷 205.210.31.128