JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.191.157.6

54.191.157.6 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 32%: ?

32%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-191-157-6.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.191.157.6

Whois 54.191.157.6

IP Abuse Reports for 54.191.157.6:

This IP address has been reported a total of 19 times from 12 distinct sources. 54.191.157.6 was first reported on July 24th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 07:00:00 (1 month ago)	Apache probe; attempts=1688; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.e ... show more Apache probe; attempts=1688; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.fly \| /.env.json \| /.env.live \| /.env.local \| /.env.neon \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.railway \| /.env.remote \| /.env.render \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.supabase \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.vault \| /.env.vercel \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| ... [211 exact paths total] show less	Web App Attack
🇫🇷 dynamix	2026-07-28 03:38:24 (1 month ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-07-27 11:39:38 (1 month ago)	Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /va ... show more Fail2Ban nginx-botsearch on Security-Instance. Persistent malicious activity detected. Evidence: /var/log/nginx/weewx.access.log:54.191.157.6 - - [27/Jul/2026:13:39:37 +0200] "GET /.env.backup2 HTTP/1.1" 404 16487 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" /var/log/nginx/weewx.access.log:54.191.157.6 - - [27/Jul/2026:13:39:37 +0200] "GET /logs/.env HTTP/1.1" 404 16487 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" /var/log/nginx/weewx.access.log:54.191.157.6 - - [27/Jul/2026:13:39:37 +0200] "GET /cache/.env HTTP/1.1" 404 16487 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" /va show less	Bad Web Bot
🇳🇱 homeshowdomain.nl	2026-07-26 22:02:12 (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-25. show less	Web App Attack SSH Hacking
🇳🇱 BlueWire Hosting	2026-07-26 04:18:12 (1 month ago)	Probing websites for vulnerabilities	Web App Attack
🇱🇻 garmtech.com	2026-07-26 04:00:34 (1 month ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 21:05:01 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 17:04:55.978034 2026] [security2:error] [pid 549707:tid 549707] [client 54.191.157.6:35210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.destintoday.com.danged.com"] [uri "/.git/config"] [unique_id "amUk91wAm6oBsogg6824rQAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 DZBOT	2026-07-25 18:45:29 (1 month ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇨🇦 CanadaCanuck1	2026-07-25 06:06:00 (1 month ago)	Attempt to access phpinfo	Web App Attack
🇨🇭 4server	2026-07-25 02:27:23 (1 month ago)	[SatJul2504:27:21.3651012026][security2:error][pid1901069:tid1901329][client54.191.157.6:0]ModSecuri ... show more [SatJul2504:27:21.3651012026][security2:error][pid1901069:tid1901329][client54.191.157.6:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.cybertelgroup.com.81-17-25-250.cpanel.site\"][uri\"/.git/config\"][unique_id\"amQfCZ6aPrxMUlJNFCqJ8gAAAM8\"] show less	Hacking Web App Attack
🇳🇱 Site.eu	2026-07-24 22:10:54 (1 month ago)	Excessive 404/403 errors	Brute-Force
🇳🇱 homeshowdomain.nl	2026-07-24 22:02:21 (1 month ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-07-24 15:14:47 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 11:14:42.184480 2026] [security2:error] [pid 491009:tid 491009] [client 54.191.157.6:42188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.d2d.aarce.me"] [uri "/.git/config"] [unique_id "amOBYsU4SavPaVPBzpINyAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-07-24 15:05:40 (1 month ago)	Scanning/Probing (12)	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 09:54:26 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.191.157.6 (ec2-54-191-157-6.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 05:54:22.895203 2026] [security2:error] [pid 3796102:tid 3796102] [client 54.191.157.6:40206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cyprus-boat-registration.com.boatregistrationdelaware.com"] [uri "/.git/config"] [unique_id "amM2TlkncsWpSWoWz78nFgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 153.117.18.210

🇺🇸 71.229.1.186

🇨🇳 36.139.229.71

🇧🇪 198.235.24.216

🇧🇷 168.205.153.255

🇺🇸 158.94.187.219

🇨🇳 124.225.4.88

🇷🇴 92.118.39.77

🇫🇷 51.77.158.34

🇻🇪 38.121.222.190

🇷🇴 2.57.121.112

🇮🇹 2.32.12.48

🇰🇷 222.232.176.7

🇮🇩 182.8.226.150

🇧🇷 177.73.43.232

🇹🇿 169.255.187.234

🇪🇨 157.100.107.236

🇨🇲 143.105.152.116

🇨🇳 124.161.224.79

🇨🇳 121.228.250.70