AbuseIPDB » 54.254.147.11
54.254.147.11
This IP was reported 10 times. Confidence of
Abuse
is 60% : ?
ISP
Amazon Data Services Japan
Usage Type
Data Center/Web Hosting/Transit
ASN
AS16509
Hostname(s)
ec2-54-254-147-11.ap-southeast-1.compute.amazonaws.com
Domain Name
amazon.com
Country
🇸🇬
Singapore
City
Singapore
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 54.254.147.11 :
This IP address has been reported a total of
10
times from
9 distinct
sources.
54.254.147.11 was first reported on
June 30th 2026 , and the most recent report was
1 hour ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
OceanTreasure
2026-07-01 07:17:17
(1 hour ago)
tcp/443; SQL backup file access attempt: "GET /backup.sql" @ 2026-07-01T07:12:41Z [proxy]
Web App Attack
🇫🇷
masterguru
2026-07-01 07:13:09
(1 hour ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-197)
show less
Hacking
🇺🇸
TPI-Abuse
2026-07-01 04:17:51
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 54.254.147.11 (ec2-54-254-147-11.ap-southeast-1 ...
show more
(mod_security) mod_security (id:210730) triggered by 54.254.147.11 (ec2-54-254-147-11.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 00:17:44.302249 2026] [security2:error] [pid 21306:tid 21306] [client 54.254.147.11:64687] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lemritz.org.shtondo.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lemritz.org.shtondo.com"] [uri "/database.sql"] [unique_id "akSU6CfscQZcNrso-uhjpwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
marcel-knorr.de
2026-07-01 00:11:31
(8 hours ago)
[MK-Root1] Blocked by UFW
Brute-Force
Port Scan
2026-06-30 18:05:14
(14 hours ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
🇫🇷
masterguru
2026-06-30 17:37:33
(15 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-195)
show less
Hacking
🇫🇮
stinpriza
2026-06-30 14:58:57
(17 hours ago)
Web App Attack
Web App Attack
🇫🇷
Octopuce
2026-06-30 11:41:02
(21 hours ago)
Aggressive web search of vulnerable pages: /backup.sql /database.sql /db_backup.sql /db.sql /dump.sq ...
show more
Aggressive web search of vulnerable pages: /backup.sql /database.sql /db_backup.sql /db.sql /dump.sql ...
show less
Web App Attack
2026-06-30 10:34:15
(22 hours ago)
[ns41.kdns.gr] httpd-suspicious-path: sites=jiotis.gr; logs=/var/log/httpd/domains/jiotis.gr.log; sa ...
show more
[ns41.kdns.gr] httpd-suspicious-path: sites=jiotis.gr; logs=/var/log/httpd/domains/jiotis.gr.log; samples=/1.sql | /backup.sql | /database.sql
show less
Hacking
Web App Attack
2026-06-30 07:53:37
(1 day ago)
Multiple web server 400 error codes from same source ip
Web App Attack
Showing 1 to
10
of 10 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: