JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 56.124.120.146

56.124.120.146 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 18%: ?

18%

ISP	Amazon Data Services Brazil
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-56-124-120-146.sa-east-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 56.124.120.146

Whois 56.124.120.146

IP Abuse Reports for 56.124.120.146:

This IP address has been reported a total of 15 times from 9 distinct sources. 56.124.120.146 was first reported on November 28th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-29 09:43:15 (1 month ago)	Automated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.env\|/. ... show more Automated Apache suspicious-path probe detected in last 15m: hits=204; wp-login_hits=0; url=/.env\|/.env.local\|/.env.production\|/.git/config\|/.env.remote\|/.env.test\|/.env.development\|/.env.bak\|(+196 more) show less	Web App Attack
Anonymous	2026-07-29 08:40:45 (1 month ago)	Automated Apache suspicious-path probe detected in last 15m: hits=151; wp-login_hits=0; url=/.git/co ... show more Automated Apache suspicious-path probe detected in last 15m: hits=151; wp-login_hits=0; url=/.git/config\|/.env\|/.env.local\|/.env.production\|/.env.staging\|/.env.development\|/.env.test\|/.env.remote\|(+143 more) show less	Web App Attack
🇩🇪 Thomas Lewis	2026-07-29 08:07:00 (1 month ago)	Scanning for .env files	Bad Web Bot Hacking
Anonymous	2026-07-29 07:05:08 (1 month ago)	Bot / scanning and/or hacking attempts: GET /.env.json HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /.env1 ... show more Bot / scanning and/or hacking attempts: GET /.env.json HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /.env1 HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.env_copy HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env.example HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.dev HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.live HTTP/1.1, GET /.env~ HTTP/1.1, GET /.env.docker HTTP/1.1, GET /.env2 HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-07-29 07:00:00 (1 month ago)	Automated Apache web application probing in selected 24h window; attempts=204, unique_paths=204, err ... show more Automated Apache web application probing in selected 24h window; attempts=204, unique_paths=204, error_responses=163; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths. show less	Web App Attack
Anonymous	2026-07-29 07:00:00 (1 month ago)	Apache probe; attempts=204; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.en ... show more Apache probe; attempts=204; exact paths: /.env \| /.env.backup \| /.env.backup1 \| /.env.backup2 \| /.env.bak \| /.env.ci \| /.env.dev \| /.env.development \| /.env.dist \| /.env.docker \| /.env.example \| /.env.json \| /.env.live \| /.env.local \| /.env.old \| /.env.preprod \| /.env.prod \| /.env.production \| /.env.remote \| /.env.sample \| /.env.save \| /.env.stage \| /.env.staging \| /.env.swp \| /.env.test \| /.env.txt \| /.env.uat \| /.env.yaml \| /.env.yml \| /.env~ \| /.git/.env \| /.git/config \| /actions/.env \| /admin-panel/.env \| /admin/.env \| /administrator/.env \| /angular/.env \| /ansible/.env \| /api/.env \| /api/dev/.env \| /api/staging/.env \| /api/v1/.env \| /api/v2/.env \| /api/v3/.env \| /app/.env \| /application/.env \| /apps/.env \| /assets/.env \| /aws/.env \| /azure/.env \| /backend/.env \| /backup/.env \| /backups/.env \| /beta/.env \| /bin/.env \| /bootstrap/.env \| /brevo/.env \| /build/.env \| /buildkite/.env \| /bulk/.env \| /cache/.en \| ... [204 exact paths total] show less	Web App Attack
🇳🇱 Savvii	2026-07-29 06:45:21 (1 month ago)	20 attempts against mh-misbehave-ban on toon	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-29 06:12:04 (1 month ago)	Excessive 404/403 errors	Brute-Force
Anonymous	2026-07-29 05:24:29 (1 month ago)	Trying to access config files	Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-29 22:59:28 (9 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2025-11-28. show less	Hacking Web App Attack SSH
🇳🇱 Savvii	2025-11-28 09:50:57 (9 months ago)	20 attempts against mh-misbehave-ban on apple	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-28 09:28:04 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 56.124.120.146 (ec2-56-124-120-146.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 56.124.120.146 (ec2-56-124-120-146.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 04:27:58.572296 2025] [security2:error] [pid 20521:tid 20521] [client 56.124.120.146:33412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "appalachianfolkmagician.com"] [uri "/.env.remote"] [unique_id "aSlrHuk4FtRj5U_CQ8wymQAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-28 07:39:16 (9 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_MODSEC	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-11-28 07:38:52 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 56.124.120.146 (ec2-56-124-120-146.sa-east-1.co ... show more (mod_security) mod_security (id:210492) triggered by 56.124.120.146 (ec2-56-124-120-146.sa-east-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 02:38:49.673714 2025] [security2:error] [pid 28664:tid 28664] [client 56.124.120.146:58166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "archivetest.jeremyscraig.com"] [uri "/.env.remote"] [unique_id "aSlRiZ_19Sf3_nQwC7mNHwAAAEw"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-28 00:08:11 (9 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.93.89.66

🇺🇾 179.27.97.205

🇨🇳 223.109.49.166

🇦🇺 216.226.77.30

🇲🇽 187.136.103.158

🇦🇷 181.199.156.76

🇻🇳 171.249.82.86

🇩🇪 136.243.228.178

🇮🇩 103.53.77.70

🇺🇸 64.62.197.35

🇧🇷 209.14.84.163

🇧🇷 177.207.248.141

🇳🇱 176.65.139.252

🇨🇿 72.63.111.195

🇭🇰 45.207.209.16

🇭🇰 199.45.154.50

🇫🇷 85.217.140.5

🇯🇵 189.81.236.127

🇺🇸 162.216.149.202

🇺🇸 155.94.233.59