JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.195.21.216

54.195.21.216 was found in our database!

This IP was reported 107 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-195-21-216.eu-west-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇮🇪 Ireland
City	Dublin, Leinster

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.195.21.216

Whois 54.195.21.216

IP Abuse Reports for 54.195.21.216:

This IP address has been reported a total of 107 times from 71 distinct sources. 54.195.21.216 was first reported on June 26th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 Celtic	2026-06-28 22:50:15 (11 hours ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
🇫🇷 tecnicorioja	2026-06-28 22:01:52 (11 hours ago)	wp-login attack [28/Jun/2026:04:32:54	Brute-Force Web App Attack
🇩🇪 FeG Deutschland	2026-06-28 21:48:59 (12 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇦🇺 paulshipley.com.au	2026-06-28 20:17:26 (13 hours ago)	shop.levellapromotions.com.au:443 54.195.21.216 - - [29/Jun/2026:06:17:23 +1000] "GET /?author=4&fee ... show more shop.levellapromotions.com.au:443 54.195.21.216 - - [29/Jun/2026:06:17:23 +1000] "GET /?author=4&feed=rss2 HTTP/1.1" 404 199537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36, Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Web App Attack
🇩🇪 iNetWorker	2026-06-28 19:59:23 (14 hours ago)	trolling for resource vulnerabilities	Web App Attack
Anonymous	2026-06-28 19:29:54 (14 hours ago)	(caddyscan) Scanner path probe from 54.195.21.216 (IE/Ireland/ec2-54-195-21-216.eu-west-1.compute.am ... show more (caddyscan) Scanner path probe from 54.195.21.216 (IE/Ireland/ec2-54-195-21-216.eu-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 302 365 54.195.21.216 - - [28/Jun/2026:19:29:49 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 302 365 54.195.21.216 - - [28/Jun/2026:19:29:49 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 302 365 54.195.21.216 - - [28/Jun/2026:19:29:49 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 302 365 54.195.21.216 - - [28/Jun/2026:19:29:49 +0000] "GET /xmlrpc.php HTTP/1.1" [REDACTED] 302 365 54.195.21.216 - - [28/Jun/2026:19:29:49 +0000] "GET /xmlrpc.php HTTP/1.1" show less	Port Scan
🇷🇴 iulianh	2026-06-28 17:48:28 (16 hours ago)	80,443	Brute-Force SSH
🇺🇸 CollideTech	2026-06-28 13:42:43 (20 hours ago)	probing for vulnerabilities	Web App Attack
🇫🇷 Security_Whaller	2026-06-28 13:41:47 (20 hours ago)	Malicious activity detected on Honeypot.	Brute-Force Hacking Web App Attack
🇨🇿 plzenskypruvodce.cz	2026-06-28 13:21:15 (20 hours ago)	2026-06-28T15:21:15.489281+02:00 web wordpress(varhanykolin.cz)[2112895]: Immediately block connecti ... show more 2026-06-28T15:21:15.489281+02:00 web wordpress(varhanykolin.cz)[2112895]: Immediately block connections from 54.195.21.216 ... show less	Brute-Force
🇮🇹 eliosbrocchi	2026-06-28 12:29:37 (21 hours ago)	2026-06-28T14:29:35.063112+02:00 thunderchild wordpress(vocidallapiazzaliberta.ddns.net)[1077541]: B ... show more 2026-06-28T14:29:35.063112+02:00 thunderchild wordpress(vocidallapiazzaliberta.ddns.net)[1077541]: Blocked user enumeration attempt from 54.195.21.216 ... show less	VPN IP
🇺🇸 xxkodedxx	2026-06-28 11:31:04 (22 hours ago)	[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10 ... show more [Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost) Trigger: 1× edge-block in 10m window. Origin: IE / AS16509 Amazon.com, Inc. Active: 11:30:48 UTC Volume: 1 HTTP req Probed: /?author=1 Status mix: 444×1 UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" Auto-banned 30d. zorvexus-banner. show less	Bad Web Bot Web App Attack
🇺🇸 jormaster3k	2026-06-28 11:15:23 (22 hours ago)	Attack against WordPress	Web App Attack
🇫🇷 Yepngo	2026-06-28 08:11:54 (1 day ago)	54.195.21.216 - - [28/Jun/2026:10:11:54 +0200] "POST /wp-login.php HTTP/2.0" 200 11380 "https://dev. ... show more 54.195.21.216 - - [28/Jun/2026:10:11:54 +0200] "POST /wp-login.php HTTP/2.0" 200 11380 "https://dev.yepngo.com/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇨🇦 KIsmay	2026-06-28 07:07:15 (1 day ago)	Jun 28 00:55:05 www4 WPAudit[3475078]: 54.195.21.216 www.lemoncreekcampground.ca "Mozilla/5.0 (X11; ... show more Jun 28 00:55:05 www4 WPAudit[3475078]: 54.195.21.216 www.lemoncreekcampground.ca "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" sbd-admin:@sbdadmin!23# FAIL Jun 28 01:45:22 www4 WPAudit[3497763]: 54.195.21.216 nelsonbcwelding.com "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0" sbd-admin:Sbdadmin@12345 FAIL Jun 28 02:01:45 www4 WPAudit[3499438]: 54.195.21.216 valhallasafety.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36" Valhalla Safety:ValhallaSafety2023 FAIL Jun 28 03:04:59 www4 WPAudit[3506497]: 54.195.21.216 hvrhaulers.com "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" sbd-admin:sbd-admin2022 FAIL Jun 28 03:07:14 www4 WPAudit[3506855]: 54.195.21.216 arcrightplumbingandheating.com "Mozilla/5.0 (Windows NT 10.0; Win64 ... show less	Brute-Force Web App Attack

Showing 1 to 15 of 107 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.9.9.109

🇧🇷 209.14.89.107

🇨🇳 203.76.241.18

🇳🇱 195.178.110.30

🇺🇸 188.241.177.235

🇺🇸 167.172.128.102

🇺🇸 165.227.23.2

🇨🇳 110.19.146.197

🇩🇪 69.5.169.94

🇧🇪 34.156.214.117

🇺🇸 16.58.56.214

🇨🇱 186.103.169.12

🇬🇧 185.247.137.118

🇩🇪 185.242.3.195

🇮🇪 185.97.239.234

🇨🇳 153.99.92.11

🇨🇳 110.188.66.227

🇺🇸 100.29.192.59

🇫🇮 89.167.59.137

🇨🇳 1.24.16.16