JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.89.241.240

52.89.241.240 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 69%: ?

69%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-52-89-241-240.us-west-2.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Boardman, Oregon

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.89.241.240

Whois 52.89.241.240

IP Abuse Reports for 52.89.241.240:

This IP address has been reported a total of 12 times from 11 distinct sources. 52.89.241.240 was first reported on July 24th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 big-cloud.nl	2026-07-26 08:00:09 (11 hours ago)	Try to access /.git/config	Web App Attack
🇺🇸 nyt	2026-07-26 06:51:58 (12 hours ago)	Sensitive File Probe	Web App Attack
🇩🇪 SCHAPPY	2026-07-26 06:06:24 (13 hours ago)	Brute-force attack to non-existent web resources, HTTP code 404.	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-07-26 05:14:02 (14 hours ago)	251 attacks on PHP URLs, VC URLs, env grabbing URLs, config grabbing URLs (type 2): GET /includes/ph ... show more 251 attacks on PHP URLs, VC URLs, env grabbing URLs, config grabbing URLs (type 2): GET /includes/phpinfo.php HTTP/1.1 GET /.git/config HTTP/1.1 GET /config/app/.env HTTP/1.1 GET /application_default_credentials.json HTTP/1.1 show less	Web App Attack Hacking
🇫🇷 COMAITE	2026-07-26 04:38:29 (14 hours ago)	Suspicious URL access.	Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 04:35:30 (14 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.89.241.240 (ec2-52-89-241-240.us-west-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 52.89.241.240 (ec2-52-89-241-240.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 00:35:22.889226 2026] [security2:error] [pid 2114493:tid 2114493] [client 52.89.241.240:43508] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.secretbureau.net.virtualvideo.org"] [uri "/.git/config"] [unique_id "amWOiiDO7VTPWNISQ5N5nwAAACU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 03:29:34 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.89.241.240 (ec2-52-89-241-240.us-west-2.comp ... show more (mod_security) mod_security (id:210492) triggered by 52.89.241.240 (ec2-52-89-241-240.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 23:29:25.712699 2026] [security2:error] [pid 2131879:tid 2131879] [client 52.89.241.240:49610] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.secemexico.com.disenowebprofesional.com"] [uri "/.git/config"] [unique_id "amV_FaURokVP-yW3Qh0C1AAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 vaia.cloud	2026-07-25 08:35:02 (1 day ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇺🇸 OceanTreasure	2026-07-25 08:17:19 (1 day ago)	tcp/443; WordPress admin access attempt: "GET /wp-admin/phpinfo.php" @ 2026-07-25T08:07:54Z [proxy]	Web App Attack
🇳🇱 debestelapp	2026-07-25 06:00:06 (1 day ago)		Web App Attack
🇳🇱 Site.eu	2026-07-24 04:04:47 (2 days ago)	Excessive 404/403 errors	Brute-Force
Anonymous	2026-07-24 03:11:05 (2 days ago)	52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh ... show more 52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "POST / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "GET /.git/config HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 52.89.241.240 - - [24/Jul/2026:05:11:03 +0200] "GET /.env HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 52 ... show less	Bad Web Bot Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 104.248.173.120

🇷🇺 89.109.51.180

🇳🇱 20.160.86.7

🇺🇸 4.246.117.137

🇩🇪 213.209.159.113

🇳🇱 185.136.15.86

🇺🇸 104.26.9.138

🇺🇸 99.105.201.171

🇨🇭 20.203.200.218

🇨🇳 121.41.104.62

🇨🇳 120.48.11.36

🇺🇸 66.132.224.81

🇭🇰 46.247.61.200

🇧🇪 35.195.116.82

🇺🇸 2607:ff10:c8:594::b

🇦🇷 201.179.144.11

🇹🇼 198.235.24.33

🇳🇱 195.178.110.30

🇮🇹 172.213.225.181

🇺🇸 165.1.64.191