JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.234.204.237

54.234.204.237 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 68%: ?

68%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-234-204-237.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.234.204.237

Whois 54.234.204.237

IP Abuse Reports for 54.234.204.237:

This IP address has been reported a total of 13 times from 11 distinct sources. 54.234.204.237 was first reported on July 24th 2026, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 HerrWolf	2026-07-26 08:30:10 (13 hours ago)	CrowdSec Detection: crowdsecurity/http-admin-interface-probing	Web App Attack
🇺🇸 bigscoots.com	2026-07-26 05:27:49 (16 hours ago)	(PERMBLOCK) 54.234.204.237 (US/United States/ec2-54-234-204-237.compute-1.amazonaws.com) has had mor ... show more (PERMBLOCK) 54.234.204.237 (US/United States/ec2-54-234-204-237.compute-1.amazonaws.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Brute-Force SSH
🇩🇪 mondor.ro	2026-07-26 03:33:59 (18 hours ago)	Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 54.234.204.237, Reason ... show more Cluster member 148.251.176.225 (DE/Germany/antares.webyouridea.ro) said, DENY 54.234.204.237, Reason:[(mod_security) mod_security (id:210492) triggered by 54.234.204.237 (US/United States/ec2-54-234-204-237.compute-1.amazonaws.com): 3 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs: show less	Port Scan
🇱🇻 garmtech.com	2026-07-26 03:01:29 (19 hours ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
🇩🇪 iNetWorker	2026-07-25 07:58:55 (1 day ago)	trolling for resource vulnerabilities	Web App Attack
🇺🇸 jsjdmediallc	2026-07-25 02:20:05 (1 day ago)	Auto-blocked: score 988 (threshold 10). Tier: HIGH. Hits: 224. Flags: phpinfo, info-file, error-scan ... show more Auto-blocked: score 988 (threshold 10). Tier: HIGH. Hits: 224. Flags: phpinfo, info-file, error-scan, joomla-admin, backup-file, server-info, server-status, env-file, test-file, git-exposure, mysql-probe, joomla-probe. Paths: /wp-admin/phpinfo.php, /administrator/phpinfo.php, /core/phpinfo.php, /includes/phpinfo.php, /webmail/phpinfo.php show less	Bad Web Bot Web App Attack
🇩🇪 on-com	2026-07-24 07:50:31 (2 days ago)	URL scan	Brute-Force Web App Attack
🇵🇱 srebrakowski.com	2026-07-24 07:40:04 (2 days ago)	crowdsec/crowdsecurity/appsec-vpatch	Brute-Force
🇵🇱 maciejka	2026-07-24 07:35:03 (2 days ago)	54.234.204.237 - - [24/Jul/2026:09:35:02 +0200] "GET /mailer/.env HTTP/1.1" 404 189 "-" "Mozilla/5.0 ... show more 54.234.204.237 - - [24/Jul/2026:09:35:02 +0200] "GET /mailer/.env HTTP/1.1" 404 189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" 54.234.204.237 - - [24/Jul/2026:09:35:02 +0200] "GET /mail/.env HTTP/1.1" 404 189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" ... show less	Bad Web Bot
🇺🇸 kosada.com	2026-07-24 06:52:39 (2 days ago)	Web vulnerability probing: /.env.staging	Web App Attack
🇱🇻 garmtech.com	2026-07-24 04:44:33 (2 days ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/.env	Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 04:43:35 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 54.234.204.237 (ec2-54-234-204-237.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 54.234.204.237 (ec2-54-234-204-237.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 00:43:30.148396 2026] [security2:error] [pid 3193321:tid 3193321] [client 54.234.204.237:48062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mspish2.com"] [uri "/.git/config"] [unique_id "amLtctfCwtUgeAXw2t-LzQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 04:09:47 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 54.234.204.237 (ec2-54-234-204-237.compute-1.am ... show more (mod_security) mod_security (id:210492) triggered by 54.234.204.237 (ec2-54-234-204-237.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 00:09:43.195854 2026] [security2:error] [pid 3163549:tid 3163549] [client 54.234.204.237:48370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mskimberleesspace.achildsspace.com"] [uri "/.git/config"] [unique_id "amLlh0gxa2MVY_5EstaWXwAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 2a09:bac5:27bf:1282::1d8:237

🇺🇸 2a09:bac1:76a0:4e0::3c0:2c

🇨🇷 190.4.88.9

🇲🇽 187.190.160.252

🇺🇸 2a09:bac1:7680:4e0::3c0:2a

🇩🇪 2a09:bac1:1e40:12d8::3a3:34

🇩🇪 2a09:bac1:1e40:12d8::3a0:37

🇩🇪 2a09:bac1:1e40:12d8::27c:e

🇺🇸 2604:a880:400:d1:0:4:6c78:a001

🇧🇷 205.210.31.173

🇮🇳 182.18.139.237

🇩🇪 178.63.0.168

🇧🇴 166.114.154.237

🇮🇹 151.42.132.82

🇺🇸 134.209.120.216

🇺🇸 113.20.0.58

🇺🇸 98.213.142.168

🇳🇱 91.92.40.24

🇮🇳 52.140.76.154

🇩🇪 2a09:bac1:1e40:12d8::27c:ad