AbuseIPDB » 54.187.137.66

54.187.137.66 was found in our database!

This IP was reported 131 times. Confidence of Abuse is 91%: ?

91%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-187-137-66.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 54.187.137.66

Whois 54.187.137.66

IP Abuse Reports for 54.187.137.66:

This IP address has been reported a total of 131 times from 88 distinct sources. 54.187.137.66 was first reported on December 9th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rshict	2024-12-11 18:01:05 (1 month ago)	Hacking, Brute-Force, Web App Attack	Hacking Brute-Force Web App Attack
Ivo Vynckier	2024-12-11 18:01:00 (1 month ago)	54.187.137.66 - - [11/Dec/2024:15:41:17 +0100] "GET /.git/config HTTP/1.1" 403 177 "-" "Mozilla/5.0 ... show more54.187.137.66 - - [11/Dec/2024:15:41:17 +0100] "GET /.git/config HTTP/1.1" 403 177 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36" show less	Hacking
vestibtech	2024-12-11 16:13:35 (1 month ago)	54.187.137.66 - - [11/Dec/2024:09:13:34 -0700] "GET /.git/config HTTP/1.1" 301 4654 "-" "Mozilla/5.0 ... show more54.187.137.66 - - [11/Dec/2024:09:13:34 -0700] "GET /.git/config HTTP/1.1" 301 4654 "-" "Mozilla/5.0 (Linux; Android 9; G8141) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36" ... show less	Web App Attack
theEngineer	2024-12-11 16:08:41 (1 month ago)	[16:08:40] 4: Exploit attempt against non-existent file - /.git/config (Repeat abuser, 11 other att ... show more[16:08:40] 4: Exploit attempt against non-existent file - /.git/config (Repeat abuser, 11 other attacks previously recorded.) show less	Hacking Bad Web Bot Web App Attack
tmiland	2024-12-11 16:04:28 (1 month ago)	(nginx_404) Dot directory Honeypot Trap 54.187.137.66 (US/United States/ec2-54-187-137-66.us-west-2. ... show more(nginx_404) Dot directory Honeypot Trap 54.187.137.66 (US/United States/ec2-54-187-137-66.us-west-2.compute.amazonaws.com): 2 in the last 3600 secs show less	Brute-Force Bad Web Bot
rdpguard.com	2024-12-11 15:34:34 (1 month ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
subnetprotocol	2024-12-11 15:10:20 (1 month ago)	11/Dec/2024:16:09:51.650427 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client ... show more11/Dec/2024:16:09:51.650427 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 54.187.137.66] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.7"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mignonne.com"] [uri "/.git/config"] [unique_id "Z1mrP_osoJH_t3CNGzN4kQAABxA"] 11/Dec/2024:16:10:00.882730 +0100Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client 54.187.137.66] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930- ... show less	Hacking Web App Attack
london2038.com	2024-12-11 15:00:36 (1 month ago)	Probing for exploits 54.187.137.66 - - [11/Dec/2024:16:00:29 +0100] "GET /.git/config HTTP/1.1 ... show moreProbing for exploits 54.187.137.66 - - [11/Dec/2024:16:00:29 +0100] "GET /.git/config HTTP/1.1" 422 0 "-" "Opera/9.80 (Android; Opera Mini/42.0.2254/150.36; U; en) Presto/2.12.423 Version/12.16" 54.187.137.66 - - [11/Dec/2024:16:00:32 +0100] "GET /.git/config HTTP/1.1" 422 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Mobile/15E148 Safari/604.1" show less	Hacking Web App Attack
ISPLtd	2024-12-11 14:50:06 (1 month ago)	Dec 11 10:50:04 SRC=54.187.137.66 PROTO=TCP SPT=56346 DPT=443 SYN Dec 11 10:50:04 SRC=54.187.1 ... show moreDec 11 10:50:04 SRC=54.187.137.66 PROTO=TCP SPT=56346 DPT=443 SYN Dec 11 10:50:04 SRC=54.187.137.66 PROTO=TCP SPT=58468 DPT=80 SYN Dec 11 10:50:04 SRC=54.187.137.66 PROTO=TCP SPT=58470 DPT=80 SYN ... show less	DDoS Attack
FeG Deutschland	2024-12-11 14:25:52 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities - 13	Exploited Host Web App Attack
el-brujo	2024-12-11 14:24:18 (1 month ago)	Cloudflare WAF: Request Path: /.git/config Request Query: Host: elhacker.net userAgent: Mozilla/5.0 ... show moreCloudflare WAF: Request Path: /.git/config Request Query: Host: elhacker.net userAgent: Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Action: block Source: firewallManaged ASN Description: AMAZON-02 Country: US Method: GET Timestamp: 2024-12-11T14:24:18Z ruleId: 23548ee2b36547a1be09bb2c0550c529. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
Hamzah Yakub	2024-12-11 14:20:11 (1 month ago)	Hacking Attempt /.git/config	Hacking Web App Attack
Burayot	2024-12-11 13:38:53 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 54.187.137.66 (US/United States/ec2- ... show moreLF_MODSEC: (mod_security) mod_security (id:949110) triggered by 54.187.137.66 (US/United States/ec2-54-187-137-66.us-west-2.compute.amazonaws.com): 2 in the last 3600 secs show less	Web App Attack
Savvii	2024-12-11 13:36:53 (1 month ago)	20 attempts against mh_ha-misbehave-ban on ceres	Brute-Force Bad Web Bot Web App Attack
smallbottle小瓶	2024-12-11 06:34:50 (1 month ago)	The IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 16509 clientASN ... show moreThe IP has triggered Cloudflare WAF. action: block source: firewallCustom clientAsn: 16509 clientASNDescription: AMAZON-02 clientCountryName: US clientIP: 54.187.137.66 clientRequestHTTPMethodName: GET clientRequestHTTPProtocol: HTTP/1.1 clientRequestPath: /.git/config clientRequestQuery: datetime: 2024-12-10T21:44:00Z rayName: 8f0069ed49e5ef6f ruleId: 4989f24696b94676961cd00c29a049bb userAgent: Opera/9.80 (J2ME/MIDP; Opera Mini/5.0.16823/1428; U; en) Presto/2.2.0. Report generated by Cloudflare-WAF-to-AbuseIPDB. show less	Web Spam Bad Web Bot