JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.236.60.166

54.236.60.166 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-236-60-166.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.236.60.166

Whois 54.236.60.166

IP Abuse Reports for 54.236.60.166:

This IP address has been reported a total of 30 times from 27 distinct sources. 54.236.60.166 was first reported on September 15th 2026, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-09-16 00:02:04 (12 hours ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇫🇷 dynamix	2026-09-15 22:15:16 (13 hours ago)	Multiple WAF Violations	Web App Attack
🇩🇪 mzaiser12	2026-09-15 22:10:21 (14 hours ago)	Web application probing: 119 requests to typical attack paths (/@fs/proc/self/cwd/.env?raw??, /_next ... show more Web application probing: 119 requests to typical attack paths (/@fs/proc/self/cwd/.env?raw??, /_next/../.aws/credentials, /_next/static/../.env, /@fs/proc/self/cwd/.aws/credentials?raw??) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network. show less	Bad Web Bot Web App Attack
🇩🇪 mzaiser12	2026-09-15 22:10:20 (14 hours ago)	Web application probing: 53 requests to typical attack paths (/.aws/credentials.bak, /.aws/credentia ... show more Web application probing: 53 requests to typical attack paths (/.aws/credentials.bak, /.aws/credentials.old, /@fs/proc/self/cwd/.aws/credentials?raw??, /.aws/config) within 5 min. Reported automatically by a SIEM; contact via abuse mailbox of the reporting network. show less	Bad Web Bot Web App Attack
🇩🇪 konseptit	2026-09-15 22:01:13 (14 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 54.236.60.166 (US/United States/ec2-54- ... show more (mod_security) mod_security triggered on hostname [redacted] 54.236.60.166 (US/United States/ec2-54-236-60-166.compute-1.amazonaws.com) show less	SQL Injection
🇩🇪 gadix	2026-09-15 22:01:02 (14 hours ago)	[16/Sep/2026:00:01:00.581043 +0200] aqnAHL2-Kkq_6ydLFe8AgAAAAIY 54.236.60.166 53804 127.0.0.1 7081 [ ... show more [16/Sep/2026:00:01:00.581043 +0200] aqnAHL2-Kkq_6ydLFe8AgAAAAIY 54.236.60.166 53804 127.0.0.1 7081 [16/Sep/2026:00:01:01.068252 +0200] aqnAHb2-Kkq_6ydLFe8AgwAAAIs 54.236.60.166 53820 127.0.0.1 7081 [16/Sep/2026:00:01:01.298863 +0200] aqnAHZinlaAIvC9ARxeTNQAAAEY 54.236.60.166 53830 127.0.0.1 7081 ... show less	Web App Attack
🇪🇸 scm	2026-09-15 21:57:10 (14 hours ago)		Web App Attack
🇫🇷 simpletech.si	2026-09-15 21:49:13 (14 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 54.236.60.166 (US/United States/ec2-54- ... show more (mod_security) mod_security triggered on hostname [redacted] 54.236.60.166 (US/United States/ec2-54-236-60-166.compute-1.amazonaws.com) show less	SQL Injection
🇺🇸 stvnrdg.me	2026-09-15 21:41:11 (14 hours ago)	54.236.60.166 - - [15/Sep/2026:21:41:11 +0000] "GET /.env.php HTTP/1.1" 404 374 "-" "Mozilla/5.0 (Ma ... show more 54.236.60.166 - - [15/Sep/2026:21:41:11 +0000] "GET /.env.php HTTP/1.1" 404 374 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15; compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php" ... show less	Hacking
🇬🇧 venus.launch.bz	2026-09-15 21:37:18 (14 hours ago)	(wpscan) WordPress probe detected from 54.236.60.166 (US/United States/ec2-54-236-60-166.compute-1.a ... show more (wpscan) WordPress probe detected from 54.236.60.166 (US/United States/ec2-54-236-60-166.compute-1.amazonaws.com) show less	Hacking
🇪🇸 robotstxt	2026-09-15 21:22:02 (14 hours ago)	54.236.60.166 - - [15/Sep/2026:21:21:59 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 291 " ... show more 54.236.60.166 - - [15/Sep/2026:21:21:59 +0000] "GET /@fs/proc/self/environ?raw?? HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.17) Gecko/20100101 Firefox/127.17; compatible; ClaudeBot/1.0; [email protected]" "-" edge="54.236.60.166" 54.236.60.166 - - [15/Sep/2026:21:22:00 +0000] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/1.1" 400 291 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:149.14) Gecko/20100101 Firefox/149.14; compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php" "-" edge="54.236.60.166" 54.236.60.166 - - [15/Sep/2026:21:22:00 +0000] "GET /@fs/../.env?raw?? HTTP/1.1" 400 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:132.10) Gecko/20100101 Firefox/132.10; compatible; ChatGPT-User/1.0; +https://openai.com/bot" "-" edge="54.236.60.166" 54.236.60.166 - - [15/Sep/2026:21:22:00 +0000] "GET /static../.azure/credentials HTTP/1.1" 400 693 "-" "Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleWebKit/537.36 (KHTM ... show less	Web Spam Web App Attack
🇨🇦 Blinker73	2026-09-15 21:17:47 (14 hours ago)	54.236.60.166 - - [15/Sep/2026:17:17:46 -0400] "GET /media../.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 ... show more 54.236.60.166 - - [15/Sep/2026:17:17:46 -0400] "GET /media../.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; WhatsApp/10.0.2.1) Chrome/151.0.1798.124 Safari/537.36" show less	Bad Web Bot Web App Attack
🇮🇩 leomardsy_	2026-09-15 21:17:14 (14 hours ago)		Port Scan
🇨🇭 SOC [GOLINE SA]	2026-09-15 21:03:25 (15 hours ago)	FortiGate detected brute force login attempt from IPv4 address 54.236.60.166	Brute-Force SSH
🇺🇸 kosada.com	2026-09-15 20:59:48 (15 hours ago)	Repeated exploit attempts, for example: /@fs/home/ec2-user/.aws/credentials?raw?? /.aws (HTTP/1.1 po ... show more Repeated exploit attempts, for example: /@fs/home/ec2-user/.aws/credentials?raw?? /.aws (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; TelegramBot/1.0) Chrome/122.0.7530.203 Safari/537.36 Edg/122.0.7530.203") show less	Web App Attack

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 104.28.163.26

🇺🇸 104.23.248.239

🇺🇸 97.170.161.72

🇺🇸 73.80.210.177

🇺🇸 35.95.125.87

🇺🇸 24.46.112.17

🇨🇳 223.109.252.203

🇬🇧 109.204.12.242

🇮🇩 36.92.140.209

🇸🇬 8.222.171.89

🇭🇰 199.45.155.27

🇩🇪 194.187.176.230

🇺🇦 194.44.50.178

🇳🇴 185.35.202.222

🇻🇳 103.110.84.229

🇺🇸 35.236.43.38

🇮🇶 5.62.149.114

🇩🇪 213.209.159.231

🇵🇱 162.158.172.229

🇧🇬 109.160.32.35