AbuseIPDB » 54.197.20.46

54.197.20.46 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 0%: ?

ISP	Amazon.com Inc.
Usage Type	Data Center/Web Hosting/Transit
Hostname(s)	ec2-54-197-20-46.compute-1.amazonaws.com
Domain Name	amazon.com
Country	United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 54.197.20.46

Whois 54.197.20.46

IP Abuse Reports for 54.197.20.46:

This IP address has been reported a total of 30 times from 23 distinct sources. 54.197.20.46 was first reported on December 23rd 2023, and the most recent report was 9 months ago.

Old Reports: The most recent abuse report for this IP address is from 9 months ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
SaferWeb	2023-12-28 15:09:27 (9 months ago)	#2 (InstallTrap) InstallTrap triggerd 54.197.20.46 (US/United States/ec2-54-197-20-46.compute-1.amaz ... show more#2 (InstallTrap) InstallTrap triggerd 54.197.20.46 (US/United States/ec2-54-197-20-46.compute-1.amazonaws.com): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Bad Web Bot Web App Attack
Anonymous	2023-12-28 12:34:39 (9 months ago)	A bad robot hit /bot-trap/index.php 2023-12-27 (Wed) 12:24:02 address is 54.197.20.46, hostname is e ... show moreA bad robot hit /bot-trap/index.php 2023-12-27 (Wed) 12:24:02 address is 54.197.20.46, hostname is ec2-54-197-20-46.compute-1.amazonaws.com, agent is Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 show less	Bad Web Bot
Buster	2023-12-27 18:49:13 (9 months ago)	Repeated script kiddie distributed attack attempts on multiple sites from Perm Blocked Extremely Hig ... show moreRepeated script kiddie distributed attack attempts on multiple sites from Perm Blocked Extremely High Risk ASN and country: show less	Open Proxy Hacking Brute-Force Web App Attack
TPI-Abuse	2023-12-27 07:37:01 (9 months ago)	(mod_security) mod_security (id:210831) triggered by 54.197.20.46 (ec2-54-197-20-46.compute-1.amazon ... show more(mod_security) mod_security (id:210831) triggered by 54.197.20.46 (ec2-54-197-20-46.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 27 02:36:56.778440 2023] [security2:error] [pid 18766] [client 54.197.20.46:41002] [client 54.197.20.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|flybits.co.uk\|F\|4"] [data "Web Downloader"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "flybits.co.uk"] [uri "/"] [unique_id "ZYvUGMBMlB5ElU8V4ccmxAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Artelis	2023-12-26 07:47:16 (9 months ago)	54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /js/bootstrap.js HTTP/1.1" 404 1805 "-" "colly - ... show more54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /js/bootstrap.js HTTP/1.1" 404 1805 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /js/jquery-1.11.3.js HTTP/1.1" 404 1804 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /js/angular.js HTTP/1.1" 404 1806 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /js/toastr.js HTTP/1.1" 404 1803 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /api/v2/ HTTP/1.1" 404 1805 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /application/x-www-form-urlencoded HTTP/1.1" 404 1802 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0" 54.197.20.46 - - [26/Dec/2023:07:47:15 +0000] "GET /text/plain HTTP/1.1" 404 1804 "-" "Mozilla/5.0 (Windows NT ... show less	Web App Attack
TPI-Abuse	2023-12-26 04:16:48 (9 months ago)	(mod_security) mod_security (id:212740) triggered by 54.197.20.46 (ec2-54-197-20-46.compute-1.amazon ... show more(mod_security) mod_security (id:212740) triggered by 54.197.20.46 (ec2-54-197-20-46.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 25 23:16:40.491906 2023] [security2:error] [pid 22170] [client 54.197.20.46:35184] [client 54.197.20.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "image\\\\/svg\\\\+xml\|text\\\\/(?:css\|html\|(?:x-)?(?:(?:ecma\|java\|vb)script\|scriptlet)).\|.application\\\\/x-shockwave-flash" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "69"] [id "212740"] [rev "6"] [msg "COMODO WAF: XSS Attack Detected\|\|acornsco.co.uk\|F\|2"] [data "Matched Data: /application/x-shockwave-flash found within REQUEST_URI: /application/x-shockwave-flash"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "acornsco.co.uk"] [uri "/application/x-shockwave-flash"] [unique_id "ZYpTqGWX99zKZezemXU8XgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
lgirvin	2023-12-26 00:00:19 (9 months ago)	[Tue Dec 26 00:00:18.931124 2023] [access_compat:error] [pid 3972414] [client 54.197.20.46:41484] AH ... show more[Tue Dec 26 00:00:18.931124 2023] [access_compat:error] [pid 3972414] [client 54.197.20.46:41484] AH01797: client denied by server configuration: /var/www/html/luke/wp-login.php, referer: https://lukegirvin.co.uk ... show less	Web App Attack
WeymouthSC	2023-12-25 19:05:15 (9 months ago)	Hacking attempt - Drupal user/register	Phishing Hacking
AvonleaConsulting	2023-12-25 17:02:25 (9 months ago)	Scanning unused Default website or suspicious access to valid sites from IP marked as abusive	Bad Web Bot Web App Attack
mangomad	2023-12-25 06:08:30 (9 months ago)	Repeated Apache mod_security rule triggers	Brute-Force Web App Attack
Aetherweb Ark	2023-12-25 02:50:14 (9 months ago)	(mod_security) mod_security (id:920450) triggered by 54.197.20.46 (US/United States/ec2-54-197-20-46 ... show more(mod_security) mod_security (id:920450) triggered by 54.197.20.46 (US/United States/ec2-54-197-20-46.compute-1.amazonaws.com): N in the last X secs show less	Web App Attack
Apache	2023-12-25 01:40:13 (9 months ago)	(mod_security) mod_security (id:20000010) triggered by 54.197.20.46 (US/United States/ec2-54-197-20- ... show more(mod_security) mod_security (id:20000010) triggered by 54.197.20.46 (US/United States/ec2-54-197-20-46.compute-1.amazonaws.com): 5 in the last 300 secs show less	Brute-Force Web App Attack
Steve	2023-12-25 01:30:57 (9 months ago)	Too many 4xx responses in a short time	Brute-Force
CryptoYakari	2023-12-23 02:27:01 (9 months ago)	54.197.20.46 - - [23/Dec/2023:05:26:58 +0300] "GET /particles.json HTTP/1.0" 404 3252 "-" "colly - h ... show more54.197.20.46 - - [23/Dec/2023:05:26:58 +0300] "GET /particles.json HTTP/1.0" 404 3252 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [23/Dec/2023:05:26:59 +0300] "GET /js/particles.json HTTP/1.0" 404 3252 "-" "colly - https://github.com/gocolly/colly/v2" 54.197.20.46 - - [23/Dec/2023:05:26:59 +0300] "GET /empty.php HTTP/1.0" 404 200 "-" "Opera/9.80 (Windows NT 10.0; U; en) Presto/2.2.15 Version/10.10" 54.197.20.46 - - [23/Dec/2023:05:26:59 +0300] "GET /getIP.php HTTP/1.0" 404 200 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" 54.197.20.46 - - [23/Dec/2023:05:26:59 +0300] "GET /garbage.php HTTP/1.0" 404 200 "-" "Opera/9.80 (Windows NT 6.1; WOW64; U; en) Presto/2.7.62 Version/11.00" ... show less	Web Spam Blog Spam Bad Web Bot Web App Attack
syokadmin	2023-12-23 00:15:22 (9 months ago)	(mod_security) mod_security (id:77225080) triggered by 54.197.20.46 (US/United States/ec2-54-197-20- ... show more(mod_security) mod_security (id:77225080) triggered by 54.197.20.46 (US/United States/ec2-54-197-20-46.compute-1.amazonaws.com): 1 in the last 3600 secs show less	Brute-Force