JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.38.53.158

54.38.53.158

Activity Trending Down

25 reports found in our database

76% ▼ ▼ ▼ Critical

Abuse confidence score ?

ISP

OVH Sp. z o. o.

Usage Type

Data Center/Web Hosting/Transit

ASN

AS16276

Hostname(s)

vps-42129552.vps.ovh.net

Domain Name

ovh.net

Country

🇵🇱 Poland

City

Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 54.38.53.158:

This IP address has been reported a total of 25 times from 20 distinct sources. 54.38.53.158 was first reported on August 28th 2026, and the most recent report was 1 week ago. In the last 60 days, the top reporter locations were: Germany with 9 reports; United States of America with 5 reports; Belgium with 2 reports. The most common categories in these recent reports were: Web App Attack 18 times; Bad Web Bot 6 times; Hacking 6 times; Brute-Force 5 times; Exploited Host 4 times; Other 3 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 palzer.IT	2026-09-03 15:03:12 (1 week ago)	Fail2ban automatic report for apache-wp-scan: 54.38.53.158 - - [02/Sep/2026:04:19:29 +0200] POST /wp ... show more Fail2ban automatic report for apache-wp-scan: 54.38.53.158 - - [02/Sep/2026:04:19:29 +0200] POST /wp-json/batch/v1 [DOMAIN_REMOVED] 404 5207 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 show less	Bad Web Bot Web App Attack
🇲🇾 Rizzy	2026-09-02 12:10:35 (1 week ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇧🇷 dominioz	2026-09-02 07:03:43 (1 week ago)	2026-09-02 07:03:04 POST /err/ 404;https://www.clinicadurand.com.br:443/wp-json/batch/v1 - 54.38.53. ... show more 2026-09-02 07:03:04 POST /err/ 404;https://www.clinicadurand.com.br:443/wp-json/batch/v1 - 54.38.53.158 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 403 245 2026-09-02 07:03:10 POST /err/ 404;https://www.clinicadurand.com.br:443/index.php?rest_route=/batch/v1 - 54.38.53.158 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 403 245 2026-09-02 07:03:12 POST /err/ 404;https://www.clinicadurand.com.br:443/index.php/wp-json/batch/v1 - 54.38.53.158 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 403 245 2026-09-02 07:03:18 POST /err/ 404;https://www.clinicadurand.com.br:443/index.php - 54.38.53.158 HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/126.0.0.0+Safari/537.36 - 403 245 ... show less	Web App Attack
🇺🇸 azminawwar	2026-09-02 05:25:59 (1 week ago)	[54.38.53.158] triggered by honeypot on port [80], Timestamp [2026-09-02T05:25:59Z]METHOD=GET PATH=/ ... show more [54.38.53.158] triggered by honeypot on port [80], Timestamp [2026-09-02T05:25:59Z]METHOD=GET PATH=/ HTTP=HTTP/1.1 UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) show less	Port Scan Hacking
🇩🇪 FeG Deutschland	2026-09-02 04:59:47 (1 week ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 28	Exploited Host Web App Attack
🇺🇸 Charlesiv	2026-09-02 04:00:26 (1 week ago)	Triggered Cloudflare WAF (botFight) from PL. Action taken: MANAGED_CHALLENGE ASN: 16276 (OVH SAS) Pr ... show more Triggered Cloudflare WAF (botFight) from PL. Action taken: MANAGED_CHALLENGE ASN: 16276 (OVH SAS) Protocol: HTTP/1.1 (GET method) Endpoint: / Timestamp: 2026-09-02T02:40:08Z Ray ID: a34925f32cedc008 UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 show less	Bad Web Bot
🇬🇧 consul.to	2026-09-02 03:19:50 (1 week ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 palzer.IT	2026-09-02 02:19:42 (1 week ago)	Fail2ban automatic report for apache-wp-scan: 54.38.53.158 - - [02/Sep/2026:04:19:29 +0200] POST /wp ... show more Fail2ban automatic report for apache-wp-scan: 54.38.53.158 - - [02/Sep/2026:04:19:29 +0200] POST /wp-json/batch/v1 [DOMAIN_REMOVED] 404 5207 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 show less	Bad Web Bot Web App Attack
🇺🇸 MPL	2026-08-31 10:01:32 (2 weeks ago)	tcp ports: 80,443 (12 or more attempts)	Port Scan
Anonymous	2026-08-31 03:58:38 (2 weeks ago)	Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probin ... show more Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools show less	Brute-Force Web App Attack
🇩🇪 ghostwarriors	2026-08-31 00:50:06 (2 weeks ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 yitzhaq	2026-08-31 00:38:05 (2 weeks ago)	54.38.53.158 - - [31/Aug/2026:02:37:58 +0200] "GET / HTTP/1.1" 200 11902 "-" "Mozilla/5.0 (Windows N ... show more 54.38.53.158 - - [31/Aug/2026:02:37:58 +0200] "GET / HTTP/1.1" 200 11902 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 54.38.53.158 - - [31/Aug/2026:02:37:59 +0200] "POST /?rest_route=/batch/v1 HTTP/1.1" 403 4563 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 54.38.53.158 - - [31/Aug/2026:02:37:59 +0200] "POST /wp-json/batch/v1 HTTP/1.1" 403 4564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 54.38.53.158 - - [31/Aug/2026:02:37:59 +0200] "GET / HTTP/1.1" 200 11902 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 54.38.53.158 - - [31/Aug/2026:02:37:59 +0200] "GET / HTTP/1.1" 301 4739 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 54.38.53. show less	Web App Attack Hacking
Anonymous	2026-08-30 22:12:59 (2 weeks ago)	Attack detected: 54.38.53.158 [2026-08-30] Categories: 21 --- wp2shell/batch exploit (1 hits) --- 54 ... show more Attack detected: 54.38.53.158 [2026-08-30] Categories: 21 --- wp2shell/batch exploit (1 hits) --- 54.38.53.158 - - [30/Aug/2026:21:24:33 +0000] "POST /?rest_route=/batch/v1 HTTP/1.1" 207 5136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" show less	Web App Attack
🇸🇪 vaia.cloud	2026-08-30 16:55:02 (2 weeks ago)	crowdsecurity/http-cve-probing	Brute-Force Web App Attack
🇩🇪 ITSNF	2026-08-30 12:45:03 (2 weeks ago)	Blocked by os-abuseipdb; 12 hits, proto=tcp, ports=443,80	Port Scan Hacking

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2a02:c207:2333:6158::1

🇺🇸 209.139.47.101

🇳🇴 158.173.166.22

🇺🇸 154.36.78.131

🇺🇸 154.36.76.52

🇳🇱 138.226.239.233

🇮🇳 49.37.209.152

🇳🇱 45.148.10.157

🇺🇸 35.255.114.177

🇧🇷 35.199.92.221

🇳🇱 34.187.43.131

🇺🇸 34.186.148.168

🇪🇸 34.175.206.180

🇩🇪 213.209.159.84

🇺🇸 204.44.109.151

🇺🇸 203.168.148.143

🇺🇸 185.249.239.61

🇺🇸 162.216.149.147

🇺🇸 162.43.244.231

🇰🇷 158.180.79.132