JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.68.28.225

54.68.28.225 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 89%: ?

89%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-68-28-225.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.68.28.225

Whois 54.68.28.225

IP Abuse Reports for 54.68.28.225:

This IP address has been reported a total of 19 times from 15 distinct sources. 54.68.28.225 was first reported on July 24th 2026, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-27 19:31:48 (9 hours ago)	(mod_security) mod_security (id:210492) triggered by 54.68.28.225 (ec2-54-68-28-225.us-west-2.comput ... show more (mod_security) mod_security (id:210492) triggered by 54.68.28.225 (ec2-54-68-28-225.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 15:31:41.859328 2026] [security2:error] [pid 11592:tid 11592] [client 54.68.28.225:52494] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.adn-media.net"] [uri "/.git/config"] [unique_id "ameyHTD_a0A9u7q3DRFt8wAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 polycoda	2026-07-27 19:21:54 (9 hours ago)	🔥 VERY AGGRESSIVE SCANNER probed over 400 inexistent files and PHP scripts in less than an hour.	Hacking Web App Attack
🇳🇱 Mangelot Hosting	2026-07-27 18:28:53 (10 hours ago)	(php_susp_dir) srv103 PHP Suspicious Directory 54.68.28.225 (US/United States/ec2-54-68-28-225.us-we ... show more (php_susp_dir) srv103 PHP Suspicious Directory 54.68.28.225 (US/United States/ec2-54-68-28-225.us-west-2.compute.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 lime	2026-07-27 18:15:33 (10 hours ago)	[Mon Jul 27 18:15:33.580243 2026] [php7:error] [pid 3269220] [client 54.68.28.225:48176] script '/va ... show more [Mon Jul 27 18:15:33.580243 2026] [php7:error] [pid 3269220] [client 54.68.28.225:48176] script '/var/www/html/p.php' not found or unable to stat [Mon Jul 27 18:15:33.600094 2026] [php7:error] [pid 3269220] [client 54.68.28.225:48176] script '/var/www/html/debug.php' not found or unable to stat show less	Hacking Web App Attack
Anonymous	2026-07-27 14:10:05 (14 hours ago)	\| Suspicious URL access.	Web App Attack Hacking SQL Injection
🇨🇦 polycoda	2026-07-27 13:54:30 (14 hours ago)	AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based ... show more AutoBlock: 🎯 Vulnerability Scanner (Non Decay-Based) - ⚙️ Configuration File Access (Non Decay-Based) show less	Hacking Bad Web Bot Web App Attack
🇫🇷 Octopuce	2026-07-27 06:59:45 (21 hours ago)	Aggressive web search of vulnerable pages: /.env /.env.local /app/.env /apps/.env /api/.env ...	Web App Attack
🇱🇻 garmtech.com	2026-07-26 07:06:44 (1 day ago)	IM360 WAF: Direct access to sensitive file or dotfile MV:/app/.env	Web App Attack
🇳🇱 Site.eu	2026-07-26 06:51:15 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇱🇻 garmtech.com	2026-07-26 06:26:18 (1 day ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
🇩🇪 4server	2026-07-26 04:21:29 (2 days ago)	[SunJul2606:21:27.1162682026][security2:error][pid1067490:tid1067560][client54.68.28.225:0]ModSecuri ... show more [SunJul2606:21:27.1162682026][security2:error][pid1067490:tid1067560][client54.68.28.225:0]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\\\\\\\\\$\\|.\\)\\\\\\\\\)\\|\\\\\\\\{.\\\\\\\\\}\)\\|[\<\>]\\\\\\\\$.\\\\\\\\\$\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$$\(41\271$\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require$child_process$.execsync$echo\$\(\(41\271$\)\\|base64-w0\).tostring.trimthrowobject.assign$newerror\(next_redirect${digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"www.alessandrolucchini.ch\"][uri\"/\"][unique_id\"amWLRwv1aGuLU7-ms-ocygAAAAw\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 homeshowdomain.nl	2026-07-25 22:07:40 (2 days ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-07-24. show less	Web App Attack SSH Hacking
Anonymous	2026-07-25 10:06:41 (2 days ago)	Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41	Port Scan
🇳🇱 homeshowdomain.nl	2026-07-24 21:59:34 (3 days ago)	Auto-ban: >3000 req/min op 2026-07-24	Web App Attack SSH Hacking
🇷🇺 DZBOT	2026-07-24 06:18:04 (3 days ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.190.126

🇺🇸 195.184.76.216

🇮🇳 139.59.84.37

🇹🇼 114.34.90.9

🇮🇩 103.140.35.140

🇳🇱 91.92.47.117

🇳🇱 91.92.47.96

🇳🇱 81.19.216.97

🇱🇹 77.90.185.78

🇳🇱 45.148.10.141

🇪🇸 37.11.188.78

🇺🇸 34.228.104.231

🇷🇴 2.57.121.25

🇧🇷 205.210.31.241

🇧🇷 170.0.62.173

🇺🇸 165.154.173.83

🇺🇸 147.185.132.52

🇺🇸 99.6.104.157

🇹🇷 94.154.43.183

🇳🇱 89.21.67.138