JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.67.59.6

54.67.59.6 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 55%: ?

55%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-67-59-6.us-west-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.67.59.6

Whois 54.67.59.6

IP Abuse Reports for 54.67.59.6:

This IP address has been reported a total of 15 times from 11 distinct sources. 54.67.59.6 was first reported on July 29th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Luhte	2026-09-17 14:40:04 (1 day ago)	Unsolicited TCP connection from 54.67.59.6 to port 0 at 2026-09-17T14:40:04Z. Source IP completed th ... show more Unsolicited TCP connection from 54.67.59.6 to port 0 at 2026-09-17T14:40:04Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking
🇳🇱 Nerdscave Hosting	2026-09-17 13:01:41 (1 day ago)	[SMB Honeypot Report] Timestamp: 2026-09-17 13:01:41 UTC Port: 53840 Attempted credentials (Base64): ... show more [SMB Honeypot Report] Timestamp: 2026-09-17 13:01:41 UTC Port: 53840 Attempted credentials (Base64): RVNNQnJ8GAF8InwCTlQgTE0gMC4xMnwCU01CIDIuMDAyfAJTTUIgMi4/Pz8= Attack Type: Unauthorized SMB connection attempt show less	Brute-Force Port Scan Hacking
🇫🇮 Birdo	2026-09-17 12:59:32 (1 day ago)	[Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained sh ... show more [Honeypot Report] Unauthorised shell access and command execution via SMB A remote host obtained shell access and executed commands. Observed: 2026-09-17 12:59 UTC \| 2 sessions \| 11 events \| SMB (port 445) Attack chain: 1. Shell access obtained; 7 distinct commands executed: SMB1 NEGOTIATE (3 dialects) ; SMB2 NEGOTIATE (5 dialects) ; SMB2 SESSION_SETUP anonymous (null session granted) Classification: scanner \| Signatures: Legacy SMB1 Dialect Negotiation Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/54.67.59.6.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Hacking Port Scan
🇦🇺 dyln	2026-09-17 12:17:30 (1 day ago)	Dyls honeypot brute-force: SMB (2 total hits)	Brute-Force
🇨🇦 Luhte	2026-09-17 11:56:48 (1 day ago)	Unsolicited TCP connection from 54.67.59.6 to port 0 at 2026-09-17T11:56:48Z. Source IP completed th ... show more Unsolicited TCP connection from 54.67.59.6 to port 0 at 2026-09-17T11:56:48Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring. show less	Port Scan Hacking
🇳🇱 i-turnradio.nl	2026-09-17 11:35:34 (1 day ago)	2026-09-17 13:35:30 +02:00 - Unsolicited TCP connection to a honeypot port; probing port 445.	Port Scan
🇺🇸 drewf.ink	2026-09-17 09:39:33 (1 day ago)	[09:39] Completed SMB2 NEGOTIATE (Type: SMB1, Dialect(s): NT LM 0.12, SMB 2.002, SMB 2.???) with no ... show more [09:39] Completed SMB2 NEGOTIATE (Type: SMB1, Dialect(s): NT LM 0.12, SMB 2.002, SMB 2.???) with no follow-up login attempt - dialect/capability recon show less	Hacking
🇨🇦 alexbfr	2026-09-17 09:14:20 (1 day ago)	Fail2Ban report from custom-honeypot; automated SMB honeypot detection.	Hacking
🇳🇱 homeshowdomain.nl	2026-07-29 22:08:23 (1 month ago)	Auto-ban: >3000 req/min op 2026-07-29	Web App Attack SSH Hacking
Anonymous	2026-07-29 11:06:40 (1 month ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
Anonymous	2026-07-29 10:43:15 (1 month ago)	Automated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.git/co ... show more Automated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.git/config\|/.env\|/.env.local\|/.env.production\|/.env.staging\|/.env.development\|/.env.test\|/.env.remote\|(+196 more) show less	Web App Attack
🇩🇪 FeG Deutschland	2026-07-29 08:14:55 (1 month ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 127	Exploited Host Web App Attack
Anonymous	2026-07-29 07:53:14 (1 month ago)	Automated Apache suspicious-path probe detected in last 1m: hits=142; wp-login_hits=0; uniq_paths=14 ... show more Automated Apache suspicious-path probe detected in last 1m: hits=142; wp-login_hits=0; uniq_paths=142 show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (1 month ago)	Automated Apache web application probing in selected 24h window; attempts=197, unique_paths=197, err ... show more Automated Apache web application probing in selected 24h window; attempts=197, unique_paths=197, error_responses=197; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (1 month ago)	Apache probe; attempts=197; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=197; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.live \| /.env.local \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.remote \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| /bin/.env \| /bootstrap/.env \| /build/.env \| /buildkite/.env \| /bulk/.env \| /cache/.env \| /cakephp/.env \| /campaign/.env \| /cd/. \| ... [197 exact paths total] show less	Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 95.90.13.168

🇱🇹 62.60.130.253

🇳🇱 45.148.10.152

🇵🇰 180.149.219.16

🇸🇳 179.64.79.46

🇫🇮 147.185.133.146

🇳🇱 45.156.128.68

🇬🇹 45.5.118.142

🇨🇳 36.33.167.165

🇶🇦 34.18.196.12

🇨🇴 201.184.50.251

🇻🇪 190.202.61.142

🇧🇷 189.90.45.77

🇳🇱 94.154.43.129

🇬🇧 206.68.81.230

🇩🇪 167.235.22.183

🇩🇪 167.94.146.34

🇸🇬 103.250.10.18

🇬🇧 80.1.51.168

🇺🇸 50.6.160.110