JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

54.215.127.47

Neutral Activity

Abuse Confidence Score

0% Low Risk

15 reports

9 reporters · latest 3 months ago

ISP: Amazon.com, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS16509
Hostname(s): ec2-54-215-127-47.us-west-1.compute.amazonaws.com
Domain Name: amazon.com
Country: 🇺🇸 United States of America
City: San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

54.215.127.47 has been reported 15 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

15 from 9 distinct reporters

First reported

July 24th 2026

Most recent report

3 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 rayhoven	2026-08-05 12:16:55 UTC · (3 months ago)	Bottracker: automated scanner traffic detected (signature: path:env-file). Sample path: /.env. 247 hits in observed period.	Hacking Web App Attack
🇨🇭 rayhoven	2026-07-30 07:47:42 UTC · (3 months ago)	Bottracker: automated scanner traffic detected (signature: path:env-file). Sample path: /.env. 247 hits in observed period.	Hacking Web App Attack
🇨🇭 rayhoven	2026-07-28 12:44:02 UTC · (3 months ago)	Bottracker: automated scanner traffic detected (signature: path:env-file). Sample path: /.env. 247 hits in observed period.	Hacking Web App Attack
🇺🇸 bigscoots.com	2026-07-28 07:31:10 UTC · (3 months ago)	(PERMBLOCK) 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-27 11:34:36 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 54.215.127.47 (ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 07:34:32.281124 2026] [security2:error] [pid ... show more (mod_security) mod_security (id:210492) triggered by 54.215.127.47 (ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 07:34:32.281124 2026] [security2:error] [pid 177718:tid 177718] [client 54.215.127.47:58286] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.mkelectricalservices.com"] [uri "/.git/config"] [unique_id "amdCSDOXXD6fWKQHYNzmQAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-26 04:25:07 UTC · (3 months ago)	(caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Ju ... show more (caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:04:25:03 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:04:25:03 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:04:25:03 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:04:25:04 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:04:25:04 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
Anonymous	2026-07-26 02:57:12 UTC · (3 months ago)	(caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Ju ... show more (caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:02:57:09 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:02:57:09 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:02:57:09 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:02:57:10 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:02:57:10 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇳🇱 WeCloudit-Anti-Abuse	2026-07-26 02:38:00 UTC · (3 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
Anonymous	2026-07-26 01:44:53 UTC · (3 months ago)	(caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Ju ... show more (caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:01:44:50 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:01:44:50 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:01:44:50 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:01:44:50 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [26/Jul/2026:01:44:50 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
Anonymous	2026-07-25 17:44:54 UTC · (3 months ago)	(caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [25/Ju ... show more (caddyscan) Scanner path probe from 54.215.127.47 (US/United States/ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 54.215.127.47 - - [25/Jul/2026:17:44:51 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [25/Jul/2026:17:44:51 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [25/Jul/2026:17:44:51 +0000] "GET /.env.local HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [25/Jul/2026:17:44:51 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 54.215.127.47 - - [25/Jul/2026:17:44:51 +0000] "GET /.env.staging HTTP/1.1" show less	Port Scan
🇳🇱 Site.eu	2026-07-25 16:09:44 UTC · (3 months ago)	Excessive 404/403 errors	Brute-Force
🇬🇧 consul.to	2026-07-25 14:43:04 UTC · (3 months ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 11:19:15 UTC · (3 months ago)	(mod_security) mod_security (id:210492) triggered by 54.215.127.47 (ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 07:19:10.163640 2026] [security2:error] [pid ... show more (mod_security) mod_security (id:210492) triggered by 54.215.127.47 (ec2-54-215-127-47.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 07:19:10.163640 2026] [security2:error] [pid 2193002:tid 2193002] [client 54.215.127.47:38160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildflowerartfarm.com"] [uri "/.git/config"] [unique_id "amSbru8RxT9I5fWRBLzmYQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-24 22:01:34 UTC · (3 months ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇳🇿 Antinson	2026-07-24 16:52:46 UTC · (3 months ago)	Scraping with a high error ratio and request rate	Bad Web Bot

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇭 202.69.171.60

🇺🇸 162.216.149.90

🇪🇨 157.100.136.90

🇺🇸 147.185.132.162

🇳🇬 102.220.45.186

🇧🇭 94.76.14.203

🇺🇸 57.151.107.218

🇺🇸 45.132.115.155

🇬🇧 5.226.140.74

🇫🇷 185.194.178.68

🇦🇷 181.174.142.133

🇮🇳 113.193.187.154

🇧🇩 103.145.45.12

🇷🇴 92.118.39.77

🇳🇱 77.239.124.68

🇬🇧 35.203.211.42

🇳🇱 195.178.110.30

🇺🇸 188.114.96.11

🇺🇸 140.235.0.246

🇳🇱 128.90.157.13