JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.38.195.241

54.38.195.241 was found in our database!

This IP was reported 235 times. Confidence of Abuse is 17%: ?

17%

ISP	OVH Sp. z o. o.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	ns3122826.serverplugs.com
Domain Name	ovh.net
Country	🇵🇱 Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.38.195.241

Whois 54.38.195.241

IP Abuse Reports for 54.38.195.241:

This IP address has been reported a total of 235 times from 74 distinct sources. 54.38.195.241 was first reported on November 3rd 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-05 19:54:20 (1 month ago)	[redacted] 54.38.195.241 - - [05/Jun/2026:21:53:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "M ... show more [redacted] 54.38.195.241 - - [05/Jun/2026:21:53:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0" [redacted] 54.38.195.241 - - [05/Jun/2026:21:53:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0" [redacted] 54.38.195.241 - - [05/Jun/2026:21:54:05 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" [redacted] 54.38.195.241 - - [05/Jun/2026:21:54:06 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0" [redacted] 54.38.195.241 - - [05/Jun/2026:21:54:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:43.0) Gecko/20100101 Firefox/43.0" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 00:38:06 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 20:38:01.376637 2026] [security2:error] [pid 14378:tid 14378] [client 54.38.195.241:34764] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.hsoftwaresystems.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.hsoftwaresystems.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aiIaaQiMCg__BnzRXIVtegAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 18:00:55 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 14:00:51.148649 2026] [security2:error] [pid 17165:tid 17165] [client 54.38.195.241:50638] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.feministvoice.blog\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.feministvoice.blog"] [uri "/wp-json/wp/v2/users"] [unique_id "aiG9U3k4cET1qhag28toRgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 16:05:46 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 12:05:39.406269 2026] [security2:error] [pid 31152:tid 31152] [client 54.38.195.241:49888] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.smoothiessoupssalads.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.smoothiessoupssalads.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiGiU1rgsCN43eYQqx4-nwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-06-04 08:57:34 (1 month ago)	Excessive multi-domain requests	Brute-Force
🇸🇪 vaia.cloud	2026-06-04 08:46:02 (1 month ago)	trying wp-login.php/xmlrpc.php 79 times in 1 minutes	Brute-Force Web App Attack
🇺🇸 bigwavedave	2026-06-04 05:29:40 (1 month ago)	Wordpress Attack	Web App Attack
🇳🇱 Site.eu	2026-06-03 16:54:26 (1 month ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 TPI-Abuse	2026-06-03 16:27:48 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 12:27:42.738112 2026] [security2:error] [pid 31597:tid 31597] [client 54.38.195.241:59662] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|lahamradio.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lahamradio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiBV_oASQ08DfryM47NlQQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 06:41:19 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 02:41:14.488357 2026] [security2:error] [pid 25213:tid 25213] [client 54.38.195.241:56710] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|coolcustomweddingproducts.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "coolcustomweddingproducts.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ah_MiuI_ZYbfk5KDZXafQgAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 FeG Deutschland	2026-05-16 03:47:39 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇩🇪 FeG Deutschland	2026-05-14 16:44:18 (2 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 15:52:53 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in ... show more (mod_security) mod_security (id:225170) triggered by 54.38.195.241 (ns3122826.serverplugs.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 11:52:45.622192 2026] [security2:error] [pid 23713:tid 23713] [client 54.38.195.241:59480] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|fltsiminc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fltsiminc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agXvzStBKyo6Noi6S7BU7AAAACY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-05-14 12:15:05 (2 months ago)	Repeated 403 errors, blocked by Fail2ban in custom-403 jail	Bad Web Bot
🇩🇪 rh24	2026-05-14 04:34:38 (2 months ago)	(wordpress-user-enum) Failed wordpress-user-enum trigger from 54.38.195.241 (FR/France/ns3122826.ser ... show more (wordpress-user-enum) Failed wordpress-user-enum trigger from 54.38.195.241 (FR/France/ns3122826.serverplugs.com): (CF_ENABLE) show less	Brute-Force

Showing 1 to 15 of 235 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇪🇸 88.82.206.71

🇫🇷 85.217.140.1

🇿🇦 197.184.80.66

🇫🇷 149.50.220.162

🇮🇳 103.159.85.123

🇧🇩 103.158.133.53

🇨🇳 182.92.142.158

🇮🇳 103.49.167.133

🇺🇸 47.251.85.109

🇺🇸 23.137.105.232

🇬🇧 2a06:4880:c000::ea

🇮🇳 223.233.67.7

🇬🇧 193.163.125.72

🇮🇩 163.227.52.50

🇨🇳 120.48.11.36

🇺🇸 66.132.172.234

🇺🇸 64.113.5.7

🇨🇳 61.186.136.36

🇨🇳 36.140.83.191

🇺🇸 23.191.200.43