JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.36.121.9

54.36.121.9 was found in our database!

This IP was reported 329 times. Confidence of Abuse is 0%: ?

ISP	OVH SAS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	ns3092520.ip-54-36-121.eu
Domain Name	ovh.net
Country	🇫🇷 France
City	Lille, Hauts-de-France

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.36.121.9

Whois 54.36.121.9

IP Abuse Reports for 54.36.121.9:

This IP address has been reported a total of 329 times from 58 distinct sources. 54.36.121.9 was first reported on May 13th 2021, and the most recent report was 4 months ago.

Old Reports: The most recent abuse report for this IP address is from 4 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 SSH-Admin	2026-02-13 19:00:05 (4 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇩🇪 Hazzard	2025-08-15 04:03:42 (10 months ago)	Port Scan detected from 54.36.121.9 (FR/France/-/-/p-eu-ngx-01.elinkapp.com/[redacted]).	Port Scan
🇩🇪 Hazzard	2025-08-13 23:10:52 (10 months ago)	Port Scan detected from 54.36.121.9 (FR/France/-/-/p-eu-ngx-01.elinkapp.com/[redacted]).	Port Scan
Anonymous	2025-08-12 18:51:27 (10 months ago)	ALTB WEBFORM SPAM 54.36.121.9 (p-eu-ngx-01.elinkapp.com)	Web Spam
🇩🇪 Hazzard	2025-08-12 06:28:40 (10 months ago)	Port Scan detected from 54.36.121.9 (FR/France/-/-/p-eu-ngx-01.elinkapp.com/[redacted]).	Port Scan
🇩🇪 FeG Deutschland	2025-08-10 02:16:25 (10 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 247	Exploited Host Web App Attack
Anonymous	2025-08-09 10:22:42 (10 months ago)	ALTB WEBFORM SPAM 54.36.121.9 (p-eu-ngx-01.elinkapp.com)	Web Spam
🇩🇪 conseilgouz	2025-08-05 21:24:29 (10 months ago)	ecw-Joomla User : try to access forms...	Hacking
🇪🇸 Serpes	2025-08-05 07:04:24 (10 months ago)	Suspicious activity detected	DDoS Attack Web App Attack
🇩🇪 conseilgouz	2025-08-05 03:11:46 (10 months ago)	dow-Joomla User : try to access forms...	Hacking
🇫🇷 conseilgouz	2025-08-04 05:31:01 (10 months ago)	scw-Joomla User : try to access forms...	Hacking
🇨🇦 polycoda	2025-08-02 21:28:00 (10 months ago)	💉 URL GET parameter and/or SQL injection attempts trying to pass quotes, backslashes, %20AND%201=1%2 ... show more 💉 URL GET parameter and/or SQL injection attempts trying to pass quotes, backslashes, %20AND%201=1%20OR%20, etc... show less	Hacking SQL Injection Web App Attack
🇮🇪 Jim Keir	2025-08-01 11:46:22 (10 months ago)	2025-08-01 11:46:21 54.36.121.9 Blacklisted IP accessed ///	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2025-07-27 08:29:29 (10 months ago)	(mod_security) mod_security (id:217210) triggered by 54.36.121.9 (p-eu-ngx-01.elinkapp.com): 1 in th ... show more (mod_security) mod_security (id:217210) triggered by 54.36.121.9 (p-eu-ngx-01.elinkapp.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 27 04:29:24.851433 2025] [security2:error] [pid 6531:tid 6531] [client 54.36.121.9:44384] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|www.golfmastercanada.com\|F\|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.golfmastercanada.com"] [uri "/"] [unique_id "aIXjZIw5V7bfLqbe0nBlngAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-07-26 11:05:24 (10 months ago)	(mod_security) mod_security (id:217210) triggered by 54.36.121.9 (p-eu-ngx-01.elinkapp.com): 1 in th ... show more (mod_security) mod_security (id:217210) triggered by 54.36.121.9 (p-eu-ngx-01.elinkapp.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 07:05:18.300827 2025] [security2:error] [pid 15149:tid 15149] [client 54.36.121.9:39256] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./](?::\\\\d+)?)?/[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S])?\|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?\|options \\\\)\\\\s+[\\\\w\\\\./]+\|get /[^?#](?:\\\\?[^#\\\\s])?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line\|\|www.vmmailing.com\|F\|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.vmmailing.com"] [uri "/"] [unique_id "aIS2brVaLK2lUplyuYEGYQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 329 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.242.226.73

🇨🇴 181.78.172.146

🇨🇳 111.57.94.240

🇱🇹 91.224.92.17

🇺🇸 50.62.135.24

🇳🇱 34.32.144.156

🇳🇱 34.7.248.224

🇧🇴 190.129.122.12

🇬🇧 176.126.78.131

🇮🇪 54.216.112.137

🇳🇱 45.148.10.147

🇬🇧 35.203.210.12

🇧🇪 34.62.109.54

🇷🇺 185.39.118.137

🇸🇬 178.128.63.38

🇺🇸 157.55.39.59

🇭🇰 152.32.211.153

🇭🇰 144.48.243.18

🇮🇳 103.54.101.248

🇸🇬 94.231.206.5