JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.184.11.16

54.184.11.16 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 94%: ?

94%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-184-11-16.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.184.11.16

Whois 54.184.11.16

IP Abuse Reports for 54.184.11.16:

This IP address has been reported a total of 24 times from 16 distinct sources. 54.184.11.16 was first reported on July 24th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-07-27 22:01:10 (22 hours ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-26. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-07-27 20:42:11 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 16:42:08.578565 2026] [security2:error] [pid 1337332:tid 1337332] [client 54.184.11.16:34352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "burnbuns.com"] [uri "/.git/config"] [unique_id "amfCoI3fjO_X1t8U9w5apwAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 polycoda	2026-07-27 19:22:56 (1 day ago)	🔥 VERY AGGRESSIVE SCANNER probed over 500 inexistent files and PHP scripts in less than an hour.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 19:16:17 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 15:16:12.312723 2026] [security2:error] [pid 580736:tid 580736] [client 54.184.11.16:48260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "burke698.org"] [uri "/.git/config"] [unique_id "ameufPbfLgl-mVTgjpX21gAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 marten_o	2026-07-27 18:36:12 (1 day ago)	54.184.11.16 - - [27/Jul/2026:20:36:11 +0200] "GET /tmp/phpinfo.php HTTP/1.1" 302 - "-" "Mozilla/5.0 ... show more 54.184.11.16 - - [27/Jul/2026:20:36:11 +0200] "GET /tmp/phpinfo.php HTTP/1.1" 302 - "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 327 320 ... show less	Web App Attack
🇫🇷 masterguru	2026-07-27 18:16:30 (1 day ago)	Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b ... show more Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b (932235-195) show less	Hacking
🇨🇦 polycoda	2026-07-27 16:11:33 (1 day ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based)	Hacking Web App Attack
🇳🇱 ReyhZhao	2026-07-27 11:07:54 (1 day ago)	Multiple ModSecurity blocks detected from a single source IP, including a restricted file access att ... show more Multiple ModSecurity blocks detected from a single source IP, including a restricted file access attempt and disallowed request content types. show less	Brute-Force
Anonymous	2026-07-27 11:06:54 (1 day ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
🇳🇱 Site.eu	2026-07-27 09:23:02 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇲🇾 Rizzy	2026-07-27 07:43:20 (1 day ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 05:12:50 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 01:12:43.982980 2026] [security2:error] [pid 3148112:tid 3148112] [client 54.184.11.16:35480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bullsalerts.com"] [uri "/.git/config"] [unique_id "amboyyIq6bwg673jcQ0u2AAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇱🇻 garmtech.com	2026-07-27 04:54:52 (1 day ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇱🇻 garmtech.com	2026-07-27 04:54:51 (1 day ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
🇺🇸 TPI-Abuse	2026-07-27 04:26:38 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.184.11.16 (ec2-54-184-11-16.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 00:26:30.240967 2026] [security2:error] [pid 1816388:tid 1816393] [client 54.184.11.16:38214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bullfrogsmusic.com"] [uri "/.git/config"] [unique_id "ambd9o7NxMXKJIVLOoxciwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.53

🇺🇸 150.107.38.180

🇳🇱 45.148.10.147

🇰🇷 43.155.172.154

🇨🇳 218.25.230.76

🇲🇿 197.242.170.10

🇧🇷 177.43.83.43

🇨🇳 124.31.42.54

🇨🇳 120.52.92.223

🇵🇰 103.113.103.132

🇺🇿 92.63.204.135

🇷🇺 78.140.32.219

🇫🇷 51.75.27.166

🇵🇰 39.63.26.109

🇺🇿 37.110.214.135

🇬🇧 35.203.211.207

🇮🇷 5.124.124.239

🇺🇿 213.230.93.85

🇹🇼 198.235.24.2

🇺🇸 192.241.145.50