JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.221.240.110

52.221.240.110 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Data Services Singapore
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-52-221-240-110.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.221.240.110

Whois 52.221.240.110

IP Abuse Reports for 52.221.240.110:

This IP address has been reported a total of 28 times from 24 distinct sources. 52.221.240.110 was first reported on August 27th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Inamin	2026-08-27 22:27:30 (1 hour ago)	52.221.240.110 - - [28/Aug/2026:06:27:28 +0800] "GET /login HTTP/2.0" 404 555 "-" "Mozilla/5.0 (Wind ... show more 52.221.240.110 - - [28/Aug/2026:06:27:28 +0800] "GET /login HTTP/2.0" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 52.221.240.110 - - [28/Aug/2026:06:27:29 +0800] "GET /admin HTTP/2.0" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ... show less	Hacking Bad Web Bot Web App Attack
🇩🇪 TheDjRider	2026-08-27 20:41:47 (3 hours ago)	CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ba ... show more CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ban triggered. Detection time (UTC): 2026-08-27T20:41:32.344971039Z. Context: http_status=404 show less	Web App Attack
🇺🇸 Lee Daniel	2026-08-27 20:17:30 (3 hours ago)	52.221.240.110 - - [27/Aug/2026:16:17:27 -0400] "GET /.aws/credentials HTTP/1.1" 404 226610 "https:/ ... show more 52.221.240.110 - - [27/Aug/2026:16:17:27 -0400] "GET /.aws/credentials HTTP/1.1" 404 226610 "https://esscoonline.com/.aws/credentials" "Mozilla/5.0 (compatible; Google-Agent; +http://www.google.com/bot.html)" ... show less	DDoS Attack Web Spam Email Spam Port Scan Brute-Force Bad Web Bot Web App Attack
🇩🇪 london2038.com	2026-08-27 20:06:07 (3 hours ago)	Malformed or malicious web request 52.221.240.110 - - [27/Aug/2026:22:06:06 +0200] "POST /graphql HT ... show more Malformed or malicious web request 52.221.240.110 - - [27/Aug/2026:22:06:06 +0200] "POST /graphql HTTP/2.0" 404 4174 "https://account.<REDACTED>" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" show less	Hacking Web App Attack
🇺🇸 nationaleventpros.com	2026-08-27 20:01:05 (3 hours ago)	vulnerability scan	Web App Attack
🇮🇩 sockominfo	2026-08-27 20:00:20 (3 hours ago)	Active Response: IP 52.221.240.110 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Re ... show more Active Response: IP 52.221.240.110 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇫🇷 giulio gorobey	2026-08-27 19:36:32 (4 hours ago)	[Drupal AbuseIPDB module] Request path is blacklisted. /wp-json	Web App Attack
🇨🇭 zynex	2026-08-27 18:36:51 (5 hours ago)	URL Probing: /.env	Web App Attack
🇺🇸 TPI-Abuse	2026-08-27 18:17:39 (5 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.221.240.110 (ec2-52-221-240-110.ap-southeast ... show more (mod_security) mod_security (id:210492) triggered by 52.221.240.110 (ec2-52-221-240-110.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 14:17:33.508304 2026] [security2:error] [pid 21891:tid 21891] [client 52.221.240.110:53166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.idahostem.org"] [uri "/.github/.env"] [unique_id "apB_PdyndirT-AUy71kYFgAAABE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-27 17:25:04 (6 hours ago)	Bot / scanning and/or hacking attempts: GET /.env.old HTTP/2.0	Hacking Web App Attack
Anonymous	2026-08-27 16:31:05 (7 hours ago)	[ns65.kdns.gr] httpd-config-scan: sites=www.digitalproject.gr; logs=/var/log/httpd/domains/digitalpr ... show more [ns65.kdns.gr] httpd-config-scan: sites=www.digitalproject.gr; logs=/var/log/httpd/domains/digitalproject.gr.log; samples=/.aws/config \| /.git/HEAD \| /.aws/credentials show less	Hacking Web App Attack
🇵🇱 Niko's Stuff	2026-08-27 15:52:01 (7 hours ago)	Triggered crowdsecurity/http-probing. More information at: https://app.crowdsec.net/cti/52.221.240.1 ... show more Triggered crowdsecurity/http-probing. More information at: https://app.crowdsec.net/cti/52.221.240.110 show less	Web App Attack Hacking
🇸🇪 vaia.cloud	2026-08-27 13:25:04 (10 hours ago)	crowdsecurity/http-probing	Brute-Force Web App Attack
Anonymous	2026-08-27 13:05:13 (10 hours ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-27 12:26:04 (11 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.221.240.110 (ec2-52-221-240-110.ap-southeast ... show more (mod_security) mod_security (id:210492) triggered by 52.221.240.110 (ec2-52-221-240-110.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 08:25:58.952544 2026] [security2:error] [pid 13088:tid 13088] [client 52.221.240.110:54360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sjtent.com"] [uri "/wp/.env"] [unique_id "apAs1vgkcL_WQItgmX90vQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇲🇴 182.93.7.194

🇺🇸 167.172.203.111

🇺🇸 159.65.65.69

🇺🇦 83.172.61.30

🇦🇿 78.109.52.227

🇬🇧 57.128.190.44

🇺🇸 34.186.49.138

🇺🇸 34.136.245.3

🇬🇧 31.14.254.13

🇺🇸 165.22.168.250

🇮🇩 103.159.199.43

🇺🇸 66.132.172.128

🇨🇳 36.140.148.41

🇪🇹 196.188.187.85

🇩🇪 193.124.20.232

🇮🇳 106.222.237.11

🇺🇸 66.132.195.61

🇬🇧 2.57.17.190

🇫🇷 2400:cb00:986:1000:31a:5575:7e36:e09d

🇰🇷 222.97.195.179