JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.193.98.172

54.193.98.172 was found in our database!

This IP was reported 6 times. Confidence of Abuse is 25%: ?

25%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-193-98-172.us-west-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.193.98.172

Whois 54.193.98.172

IP Abuse Reports for 54.193.98.172:

This IP address has been reported a total of 6 times from 5 distinct sources. 54.193.98.172 was first reported on August 29th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 yitzhaq	2026-07-29 22:02:18 (2 days ago)	54.193.98.172 - - [29/Jul/2026:12:14:29 +0200] "GET /includes/phpinfo.php HTTP/1.1" 404 631 "-" "Moz ... show more 54.193.98.172 - - [29/Jul/2026:12:14:29 +0200] "GET /includes/phpinfo.php HTTP/1.1" 404 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.193.98.172 - - [29/Jul/2026:12:14:29 +0200] "GET /service-account.json HTTP/1.1" 404 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.193.98.172 - - [29/Jul/2026:12:14:29 +0200] "GET /sa.json HTTP/1.1" 404 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.193.98.172 - - [29/Jul/2026:12:14:29 +0200] "GET /gcp-key.json HTTP/1.1" 404 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.193.98.172 - - [29/Jul/2026:12:14:30 +0200] "GET /gcp-credentials.json HTTP/1.1" 404 631 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.193.98.172 - - [29 show less	Web App Attack Hacking
Anonymous	2026-07-29 07:00:00 (3 days ago)	Automated Apache web application probing in selected 24h window; attempts=204, unique_paths=204, err ... show more Automated Apache web application probing in selected 24h window; attempts=204, unique_paths=204, error_responses=0; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (3 days ago)	Apache probe; attempts=204; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=204; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.remote \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| /bin/.env \| /bootstrap/.env \| /brevo/.env \| /build/.env \| /buildkite/.env \| /bulk/.env \| /cache/.en \| ... [204 exact paths total] show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-29 05:41:54 (3 days ago)	(mod_security) mod_security (id:210492) triggered by 54.193.98.172 (ec2-54-193-98-172.us-west-1.comp ... show more (mod_security) mod_security (id:210492) triggered by 54.193.98.172 (ec2-54-193-98-172.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 29 01:41:46.101733 2026] [security2:error] [pid 2265272:tid 2265272] [client 54.193.98.172:53768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.bizecommnet.bizecomm.com"] [uri "/.git/config"] [unique_id "ammSmp9Rk6gv6i3EtiodbwAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
🇰🇷 windykc	2026-07-29 05:30:07 (3 days ago)	Honeypot first-observation (no prior AbuseIPDB reports). HTTP: 242 attacks (sample URIs: ['/ansible/ ... show more Honeypot first-observation (no prior AbuseIPDB reports). HTTP: 242 attacks (sample URIs: ['/ansible/.env', '/job/.env', '/resources/.env', '/old/.env', '/transactional/.env']). RCE/web-shell attempts: 37 (fake-shell endpoint). Geo/ISP: US/Amazon.com, Inc.. Last seen: 2026-07-29T13:57:00Z. show less	Hacking Web App Attack
🇨🇦 Largnet SOC	2024-08-29 00:18:47 (1 year ago)	54.193.98.172 triggered Icarus honeypot on port 143. Check us out on github.	Port Scan Hacking

Showing 1 to 6 of 6 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.210.31.87

🇸🇬 94.231.206.12

🇷🇴 2.57.121.112

🇺🇸 195.184.76.124

🇺🇸 147.185.132.45

🇳🇱 91.92.40.41

🇲🇩 80.96.108.192

🇩🇪 46.114.19.196

🇫🇮 45.148.101.101

🇮🇩 36.64.131.68

🇺🇸 31.77.227.120

🇯🇵 8.216.38.66

🇮🇷 213.176.26.114

🇸🇬 159.65.5.51

🇰🇷 121.176.219.68

🇰🇷 119.207.3.114

🇷🇺 81.211.72.167

🇨🇳 58.19.141.97

🇸🇪 4.223.140.16

🇺🇸 2604:a880:400:d1:0:4:c61c:4001