JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.197.136.251

54.197.136.251 was found in our database!

This IP was reported 69 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-197-136-251.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.197.136.251

Whois 54.197.136.251

IP Abuse Reports for 54.197.136.251:

This IP address has been reported a total of 69 times from 48 distinct sources. 54.197.136.251 was first reported on July 18th 2026, and the most recent report was 44 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-20 17:57:53 (44 minutes ago)	Trapped by Fail2Ban: Too many login failures from 54.197.136.251	Brute-Force Hacking
🇩🇪 Dominik Lysiak	2026-07-20 17:38:25 (1 hour ago)	54.197.136.251 - - [20/Jul/2026:19:38:24 +0200] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows ... show more 54.197.136.251 - - [20/Jul/2026:19:38:24 +0200] "GET /.env HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586" 54.197.136.251 - - [20/Jul/2026:19:38:24 +0200] "GET /.git/config HTTP/1.1" 404 179 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11" 54.197.136.251 - - [20/Jul/2026:19:38:24 +0200] "GET /.env HTTP/1.1" 404 179 "-" "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" ... show less	Web App Attack
🇦🇹 René Hickersberger	2026-07-20 17:22:42 (1 hour ago)	malicious bot detected: violations="hit-honeypot"; user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; ... show more malicious bot detected: violations="hit-honeypot"; user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; WOW64; rv:41.0) Gecko/20100101 Firefox/140.0.1 (x64 de)" show less	Web App Attack
🇺🇸 billfor	2026-07-20 17:11:22 (1 hour ago)	54.197.136.251 - - [20/Jul/2026:13:11:18 -0400] "GET /.env HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows ... show more 54.197.136.251 - - [20/Jul/2026:13:11:18 -0400] "GET /.env HTTP/1.1" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0" show less	Web App Attack
🇵🇱 nakordoni.eu	2026-07-20 14:00:02 (4 hours ago)	Blocked by nakordoni.eu automated security: nakordoni-probe-gate. Jail: nakordoni-probe-gate, 1 matc ... show more Blocked by nakordoni.eu automated security: nakordoni-probe-gate. Jail: nakordoni-probe-gate, 1 matches. ISP: Amazon.com, Inc. (US), Usage: Data Center/Web Hosting/Transit. Prior AbuseIPDB score at ban time: 100/100. show less	Bad Web Bot Web App Attack
🇮🇹 Inartis	2026-07-20 13:15:08 (5 hours ago)	54.197.136.251 - - [20/Jul/2026:15:15:06 +0200] "GET /.git/config HTTP/1.1" 301 5682 "-" "Mozilla/5. ... show more 54.197.136.251 - - [20/Jul/2026:15:15:06 +0200] "GET /.git/config HTTP/1.1" 301 5682 "-" "Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/4.0" 54.197.136.251 - - [20/Jul/2026:15:15:06 +0200] "GET /.env HTTP/1.1" 301 5668 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15" 54.197.136.251 - - [20/Jul/2026:15:15:06 +0200] "GET /.env HTTP/1.1" 403 5407 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Takesh	2026-07-20 13:03:25 (5 hours ago)	Numbase auto-report: sensitive_honeypot:/.env	Bad Web Bot
🇩🇪 kkwemi	2026-07-20 11:36:51 (7 hours ago)	Blocked by block-exploit-paths on /.env	Bad Web Bot
🇺🇸 Major Hostility	2026-07-20 10:54:55 (7 hours ago)	"GET /.git/config HTTP/1.1" 404 "GET /.env HTTP/1.1" 404 "GET /.git/config HTTP/1.1" 404	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 08:10:30 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 54.197.136.251 (ec2-54-197-136-251.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 54.197.136.251 (ec2-54-197-136-251.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 04:10:25.438046 2026] [security2:error] [pid 26070:tid 26070] [client 54.197.136.251:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.atlascoombs.com"] [uri "/.env"] [unique_id "al3X8fatlW_yzKuQQiwgogAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 mnazibo	2026-07-20 08:00:44 (10 hours ago)	Date: Jul 20 10:57:28 2026 EAT \| Reported IP: 54.197.136.251 mod_security \| id: 930130 949110 \| US/u ... show more Date: Jul 20 10:57:28 2026 EAT \| Reported IP: 54.197.136.251 mod_security \| id: 930130 949110 \| US/usernameab.my_domain/- \| Connections: 1 \| Blocked: Permanent Block: [LF_MODSEC] \| Logs: ; Restricted File Access Attempt; Restricted File Access Attempt; Inbound Anomaly Score Exceeded (Total Score: 5); Inbound Anomaly Score Exceeded (Total Score: 5) show less	SQL Injection Brute-Force Bad Web Bot
Anonymous	2026-07-20 07:00:07 (11 hours ago)	[BestVouchers.net] Honeypot trap triggered \| Path: /.env \| Time: 2026-07-20T07:00:07.593Z \| UA: Mozi ... show more [BestVouchers.net] Honeypot trap triggered \| Path: /.env \| Time: 2026-07-20T07:00:07.593Z \| UA: Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.0 \| Action: Automatically blocked for 24h and reported show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 05:42:42 (13 hours ago)	(mod_security) mod_security (id:210492) triggered by 54.197.136.251 (ec2-54-197-136-251.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 54.197.136.251 (ec2-54-197-136-251.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 01:42:37.802832 2026] [security2:error] [pid 9779:tid 9779] [client 54.197.136.251:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nyemdr.org"] [uri "/.env"] [unique_id "al21TY1rLUQITV3IrYrPkwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 etu brutus	2026-07-20 04:14:10 (14 hours ago)	54.197.136.251 Blocked by [Attack Vector List] ...	Hacking Brute-Force Exploited Host
🇬🇧 gurnip	2026-07-20 02:45:58 (15 hours ago)	Vulnerability probe of page /.env, not found on server.	Brute-Force Web App Attack

Showing 1 to 15 of 69 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a04:4e40:e000:0:d40:bded:8047:d569

🇩🇪 2a04:4e40:e000:0:787:3f2e:e690:159c

🇯🇵 2406:da16:b16:bb01:e18d:14ae:c126:473a

🇧🇷 187.109.182.89

🇨🇳 183.162.100.184

🇩🇪 140.248.75.162

🇺🇸 31.58.179.214

🇺🇸 20.55.45.217

🇬🇧 2.57.17.46

🇵🇰 2407:aa80:14:c007:e44f:3cd0:59b5:4784

🇺🇸 167.99.153.4

🇧🇩 161.248.189.72

🇹🇼 114.35.59.237

🇫🇷 91.231.89.151

🇮🇹 79.3.96.178

🇱🇹 77.90.185.20

🇬🇧 35.203.211.187

🇺🇸 2a04:4e40:e040:0:bfc:dbb8:5aa6:e528

🇺🇸 2a04:4e40:e010:0:bfc:dbb8:5aa6:e528

🇧🇪 198.235.24.217