JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 52.91.222.224

52.91.222.224 was found in our database!

This IP was reported 30 times. Confidence of Abuse is 100%: ?

100%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-52-91-222-224.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 52.91.222.224

Whois 52.91.222.224

IP Abuse Reports for 52.91.222.224:

This IP address has been reported a total of 30 times from 26 distinct sources. 52.91.222.224 was first reported on July 8th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 LRob	2026-07-11 07:49:20 (7 hours ago)	CrowdSec: crowdsecurity/http-probing \| req: ["/config/master.key","/application.properties/","/appli ... show more CrowdSec: crowdsecurity/http-probing \| req: ["/config/master.key","/application.properties/","/application.yml","/application.yaml","/web.config/","/Web.config/","/appsettings.json","/appsettings.Development.json","/appsettings.Production.json","/app/config/parameters.yml","/google-services.js \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"] show less	Port Scan Web App Attack
🇩🇪 LRob	2026-07-11 06:49:02 (8 hours ago)	CrowdSec: crowdsecurity/http-probing \| req: ["/debug/","/actuator/","/.well-known/openid-configurati ... show more CrowdSec: crowdsecurity/http-probing \| req: ["/debug/","/actuator/","/.well-known/openid-configuration/","/404/","/.well-known/jwks.json","/wp-includes/","/debug/vars/","/actuator/env/","/.well-known/assetlinks.json","/actuator/configprops/","/metrics/"] \| UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"] show less	Port Scan Web App Attack
🇲🇽 octageeks.com	2026-07-11 04:19:18 (10 hours ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇩🇪 netclix.gr	2026-07-11 01:50:58 (13 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 52.91.222.224 (US/United States/ec2-52- ... show more (mod_security) mod_security triggered on hostname [redacted] 52.91.222.224 (US/United States/ec2-52-91-222-224.compute-1.amazonaws.com): (CF_ENABLE) show less	SQL Injection
🇺🇸 TPI-Abuse	2026-07-10 23:06:14 (15 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.91.222.224 (ec2-52-91-222-224.compute-1.amaz ... show more (mod_security) mod_security (id:210492) triggered by 52.91.222.224 (ec2-52-91-222-224.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 19:06:07.348673 2026] [security2:error] [pid 21264:tid 21264] [client 52.91.222.224:49722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "benny-wong.net"] [uri "/.env"] [unique_id "alF63x6506ZnmuUjD3YSnAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 BlueWire Hosting	2026-07-10 19:07:46 (19 hours ago)	Probing websites for vulnerabilities	Web App Attack
🇬🇧 noise.agency	2026-07-10 18:57:11 (19 hours ago)	52.91.222.224 (US/United States/ec2-52-91-222-224.compute-1.amazonaws.com), more than 10 Apache 403 ... show more 52.91.222.224 (US/United States/ec2-52-91-222-224.compute-1.amazonaws.com), more than 10 Apache 403 hits show less	Hacking
🇦🇺 paulshipley.com.au	2026-07-10 18:00:19 (20 hours ago)	[Sat Jul 11 04:00:18.204366 2026] [security2:error] [pid 629780] [client 52.91.222.224:52412] [clien ... show more [Sat Jul 11 04:00:18.204366 2026] [security2:error] [pid 629780] [client 52.91.222.224:52412] [client 52.91.222.224] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 25)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "angleseaarthouse.com.au"] [uri "/"] [unique_id "alEzMjp27KpX_HF6EuurZAAAAAc"] ... show less	Web App Attack
🇳🇱 Savvii	2026-07-10 16:33:36 (22 hours ago)	20 attempts against mh-misbehave-ban on pavo	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-10 15:35:04 (23 hours ago)	Bot / scanning and/or hacking attempts: [1/1] done, GET /Web.config HTTP/2.0, GET /actuator HTTP/2.0 ... show more Bot / scanning and/or hacking attempts: [1/1] done, GET /Web.config HTTP/2.0, GET /actuator HTTP/2.0, GET /appsettings.Development.json HTTP/2.0, GET /app/config/parameters.yml HTTP/2.0, GET /appsettings.Production.json HTTP/2.0, GET /settings.py HTTP/2.0, GET /stats/ HTTP/2.0, GET /.travis.yml HTTP/2.0, GET /GoogleService-Info.plist HTTP/2.0, GET /awsconfiguration.json HTTP/2.0, GET /wp-config.php.txt HTTP/2.0, GET /.aws/credentials HTTP/2.0, GET /config/database.yml HTTP/2.0, GET /.circleci/config.yml HTTP/2.0, GET /google-services.json HTTP/2.0, GET /firebaseConfig.js HTTP/2.0, GET /aws-exports.js HTTP/2.0, GET /local_settings.py HTTP/2.0, GET /firebase.json HTTP/2.0, GET /.gitlab-ci.yml HTTP/2.0, GET /service-account.json HTTP/2.0, GET /application.yaml HTTP/2.0 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 15:10:41 (23 hours ago)	(mod_security) mod_security (id:210492) triggered by 52.91.222.224 (ec2-52-91-222-224.compute-1.amaz ... show more (mod_security) mod_security (id:210492) triggered by 52.91.222.224 (ec2-52-91-222-224.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 11:10:33.873385 2026] [security2:error] [pid 8012:tid 8012] [client 52.91.222.224:39476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "computerian.net"] [uri "/.env"] [unique_id "alELaZ6bpRN6eOYEGnvyFgAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 danchoivanov	2026-07-10 14:21:32 (1 day ago)	Automated scanner probing /debug on simpleitsrq.com. Auto-blocked by honeypot trap.	Web App Attack Hacking
🇺🇸 ph	2026-07-10 14:07:14 (1 day ago)	Bad web bot attempting to run wp-content on non-WP site	Hacking Bad Web Bot Web App Attack
🇺🇸 WellSpring	2026-07-10 13:47:32 (1 day ago)	backup exfil on 214.today/db.sql — WellSpr.ing/NetSentinel civic-AI security layer	Web App Attack
🇬🇧 Oakley	2026-07-10 13:45:29 (1 day ago)	(confirmed_bot_sig) Confirmed bot	Hacking

Showing 1 to 15 of 30 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2600:3c00::2000:79ff:fed9:bcb8

🇸🇬 165.22.60.26

🇬🇧 154.16.44.99

🇲🇾 49.125.201.80

🇮🇳 14.139.112.154

🇸🇪 2a04:4e40:4400:0:830:a896:47cd:85db

🇨🇦 209.50.179.149

🇹🇼 198.235.24.64

🇲🇽 187.190.35.163

🇰🇷 115.91.48.142

🇨🇦 104.207.48.3

🇧🇩 103.112.54.86

🇻🇳 14.226.198.31

🇺🇸 2605:a601:adf9:2800:c88e:ec97:a7:e35

🇰🇷 218.51.148.194

🇰🇷 211.53.58.10

🇸🇬 194.61.41.72

🇲🇽 189.194.140.170

🇷🇺 154.83.196.237

🇩🇪 104.207.50.15