JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.197.216.120

54.197.216.120 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 0%: ?

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-197-216-120.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.197.216.120

Whois 54.197.216.120

IP Abuse Reports for 54.197.216.120:

This IP address has been reported a total of 56 times from 40 distinct sources. 54.197.216.120 was first reported on December 23rd 2025, and the most recent report was 8 months ago.

Old Reports: The most recent abuse report for this IP address is from 8 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2025-12-24 22:59:39 (8 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2025-12-23. show less	Hacking Web App Attack SSH
🇬🇧 openstrike.co.uk	2025-12-24 06:14:59 (8 months ago)	2 attacks on VC URLs: GET /.git/config HTTP/1.1	Hacking
🇺🇸 pduggusa	2025-12-24 03:25:33 (8 months ago)	Detected attacking dugganusa.com at 2025-12-24T03:25:33.317Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2025-12-24T03:25:33.317Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	DDoS Attack Hacking
🇺🇸 pduggusa	2025-12-24 02:37:04 (8 months ago)	Detected attacking dugganusa.com at 2025-12-24T02:37:04.321Z \| Attack: Web Service \| Source: DugganU ... show more Detected attacking dugganusa.com at 2025-12-24T02:37:04.321Z \| Attack: Web Service \| Source: DugganUSA PreCog auto-block show less	DDoS Attack Hacking
🇬🇧 [email protected]	2025-12-24 00:55:50 (8 months ago)	...	Brute-Force SSH
🇬🇧 AvonleaConsulting	2025-12-23 23:59:56 (8 months ago)	Attempts to probe web pages for vulnerable PHP or other applications	Web App Attack
🇳🇱 homeshowdomain.nl	2025-12-23 23:04:12 (8 months ago)	Auto-ban: >3000 req/min op 2025-12-23	Hacking Web App Attack SSH
Anonymous	2025-12-23 12:24:08 (8 months ago)	"GET /.git/config HTTP/1.1"	Hacking Web App Attack
🇺🇸 Rip	2025-12-23 08:30:23 (8 months ago)	Automated recon attempt targeting restricted and sensitive paths.	Web App Attack
🇺🇸 lnklnx	2025-12-23 07:15:07 (8 months ago)	translate.lnklnx.com:443 54.197.216.120 - - [23/Dec/2025:01:15:04 -0600] "GET /.git/config HTTP/1.1" ... show more translate.lnklnx.com:443 54.197.216.120 - - [23/Dec/2025:01:15:04 -0600] "GET /.git/config HTTP/1.1" 404 4309 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" ... show less	Web App Attack
🇧🇬 Filipe Dávila	2025-12-23 07:13:23 (8 months ago)	[Tue Dec 23 02:13:21.370690 2025] [:error] [pid 588397:tid 140374270002944] [client 54.197.216.120:4 ... show more [Tue Dec 23 02:13:21.370690 2025] [:error] [pid 588397:tid 140374270002944] [client 54.197.216.120:40520] [client 54.197.216.120] [redacted]: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "[redacted][redacted]"] [[redacted] "233"] [id "[redacted]"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "[redacted]/4.7.0-dev"] [tag "[redacted]"] [tag "[redacted]"] [hostname "training.[redacted]"] [uri "/.git/config"] [unique_id "aUpBEYnpIIiyalfJIJ1S6wAAAFQ"] show less	Web App Attack
🇺🇸 TPI-Abuse	2025-12-23 07:02:04 (8 months ago)	(mod_security) mod_security (id:210492) triggered by 54.197.216.120 (ec2-54-197-216-120.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 54.197.216.120 (ec2-54-197-216-120.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 23 02:01:59.280897 2025] [security2:error] [pid 8539:tid 8539] [client 54.197.216.120:33516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mightyhoop.com"] [uri "/.git/config"] [unique_id "aUo-Zw2X-Uh9YVsIJygYiAAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 AvonleaConsulting	2025-12-23 06:53:35 (8 months ago)	Scanning unused Default website or suspicious access to valid sites from IP marked as abusive	Bad Web Bot Web App Attack
🇫🇷 mrcrassi	2025-12-23 06:42:52 (8 months ago)	Triggered Cloudflare WAF (botFight) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET ... show more Triggered Cloudflare WAF (botFight) from US. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /.git/config UA: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 bescared	2025-12-23 06:14:16 (8 months ago)	F2B - Malicious activity detected. URL Probing.	Hacking Bad Web Bot Web App Attack

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 222.116.28.56

🇹🇬 196.171.76.194

🇵🇱 83.219.248.100

🇺🇸 71.235.27.139

🇺🇸 50.6.207.27

🇺🇸 45.194.67.47

🇬🇧 35.203.211.89

🇺🇸 34.42.236.107

🇺🇸 23.94.183.169

🇨🇦 20.220.204.93

🇨🇳 222.90.233.165

🇺🇸 216.25.89.138

🇳🇱 193.47.62.69

192.168.34.77

172.25.108.66

172.21.96.214

🇩🇪 167.233.141.18

🇳🇱 91.92.42.172

🇺🇸 64.62.156.44

🇬🇧 35.203.211.86