JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.188.121.222

54.188.121.222 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 62%: ?

62%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-188-121-222.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.188.121.222

Whois 54.188.121.222

IP Abuse Reports for 54.188.121.222:

This IP address has been reported a total of 12 times from 10 distinct sources. 54.188.121.222 was first reported on July 24th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-07-28 22:00:53 (7 hours ago)	Auto-ban: >3000 req/min op 2026-07-28	Web App Attack SSH Hacking
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-07-28 02:57:02 (1 day ago)	54.188.121.222 - - [27/Jul/2026:20:57:01 -0600] "GET /.git/config HTTP/1.1" 300 4767 "-" "Mozilla/5. ... show more 54.188.121.222 - - [27/Jul/2026:20:57:01 -0600] "GET /.git/config HTTP/1.1" 300 4767 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 dynamix	2026-07-28 02:19:25 (1 day ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 15:13:00 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.188.121.222 (ec2-54-188-121-222.us-west-2.co ... show more (mod_security) mod_security (id:210492) triggered by 54.188.121.222 (ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 11:12:53.114533 2026] [security2:error] [pid 3788722:tid 3788722] [client 54.188.121.222:43928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karenjoyce.com"] [uri "/.git/config"] [unique_id "amd1ddItNGjD_QYaOh0yRgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 14:51:59 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.188.121.222 (ec2-54-188-121-222.us-west-2.co ... show more (mod_security) mod_security (id:210492) triggered by 54.188.121.222 (ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 10:51:52.712755 2026] [security2:error] [pid 204783:tid 204783] [client 54.188.121.222:36590] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "karendraughon.com"] [uri "/.git/config"] [unique_id "amdwiGzcVxKqMGGFElQcxwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-07-27 04:21:33 (2 days ago)	(modsecurity) srv104 ModSecurity 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.compu ... show more (modsecurity) srv104 ModSecurity 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
Anonymous	2026-07-27 01:18:32 (2 days ago)	(caddyscan) Scanner path probe from 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.co ... show more (caddyscan) Scanner path probe from 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:01:18:31 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:01:18:31 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:01:18:31 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:01:18:32 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:01:18:32 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
Anonymous	2026-07-27 00:15:12 (2 days ago)	(caddyscan) Scanner path probe from 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.co ... show more (caddyscan) Scanner path probe from 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:00:15:07 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:00:15:07 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:00:15:07 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:00:15:07 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.188.121.222 - - [27/Jul/2026:00:15:07 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇩🇪 R.G.	2026-07-27 00:12:03 (2 days ago)	(ScanningForFiles) Scanning for files triggerd 54.188.121.222 (US/United States/ec2-54-188-121-222.u ... show more (ScanningForFiles) Scanning for files triggerd 54.188.121.222 (US/United States/ec2-54-188-121-222.us-west-2.compute.amazonaws.com): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇦🇺 Lazarus	2026-07-26 01:12:52 (3 days ago)	HTTP probe.	Web App Attack
🇬🇧 Celtic	2026-07-25 12:19:30 (3 days ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇮🇹 VHosting	2026-07-24 18:40:04 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2604:a880:400:d1:0:4:c24f:c001

🇵🇰 223.123.92.132

🇩🇪 213.209.159.25

🇮🇩 202.149.86.236

🇹🇭 202.29.220.106

🇳🇱 185.226.197.45

🇺🇸 159.223.138.23

🇦🇺 101.180.24.165

🇫🇷 91.196.152.183

🇹🇷 88.246.197.239

🇨🇦 85.217.149.68

🇫🇷 85.217.140.16

🇺🇸 69.4.83.194

🇫🇷 51.75.236.136

🇮🇳 20.192.5.254

🇺🇸 2604:a880:400:d1:0:4:c24f:e001

🇮🇳 202.141.102.22

🇧🇪 198.235.24.216

🇲🇿 197.219.228.246

🇬🇧 195.96.139.242