JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.241.91.110

54.241.91.110 was found in our database!

This IP was reported 7 times. Confidence of Abuse is 31%: ?

31%

ISP	Amazon Technologies Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-241-91-110.us-west-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	San Jose, California

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.241.91.110

Whois 54.241.91.110

IP Abuse Reports for 54.241.91.110:

This IP address has been reported a total of 7 times from 6 distinct sources. 54.241.91.110 was first reported on June 24th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-06-25 22:04:12 (2 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-24. show less	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-06-24 21:59:52 (2 weeks ago)	Auto-ban: >3000 req/min op 2026-06-24	Web App Attack SSH Hacking
Anonymous	2026-06-24 07:26:03 (2 weeks ago)	Bot / scanning and/or hacking attempts: GET /env_2.txt HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.env-e ... show more Bot / scanning and/or hacking attempts: GET /env_2.txt HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.env-example HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.old HTTP/1.1, GET /env.example HTTP/1.1, GET /fake-env-backup.txt HTTP/1.1, GET /.envrc.sample HTTP/1.1, GET /.env.prod HTTP/1.1, GET /.env_example HTTP/1.1, GET /.env_copy HTTP/1.1, GET /.env.swp HTTP/1.1, GET /.env.json HTTP/1.1, GET /.env1 HTTP/1.1, GET /env.txt HTTP/1.1, GET /.env.production.example HTTP/1.1, GET /.env-backup HTTP/1.1, GET /.env2 HTTP/1.1, GET /.env.example-local HTTP/1.1, GET /.env.dev.example HTTP/1.1, GET /.env~ HTTP/1.1 show less	Hacking Web App Attack
🇬🇧 markawes	2026-06-24 07:16:42 (2 weeks ago)	[markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. ... show more [markis] Auto banned by Fail2Ban. Reason: Malicious web scan / attempted access to sensitive paths. Evidence: 54.241.91.110 - - [24/Jun/2026:08:16:41 +0100] "GET /.git/config HTTP/1.1" 404 517 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.241.91.110 - - [24/Jun/2026:08:16:42 +0100] "GET /.env HTTP/1.1" 404 517 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.241.91.110 - - [24/Jun/2026:08:16:42 +0100] "GET /.env.local HTTP/1.1" 404 517 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Port Scan Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 07:07:59 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 54.241.91.110 (ec2-54-241-91-110.us-west-1.comp ... show more (mod_security) mod_security (id:210492) triggered by 54.241.91.110 (ec2-54-241-91-110.us-west-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 03:07:54.506562 2026] [security2:error] [pid 32322:tid 32322] [client 54.241.91.110:56176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.markgiffin.com"] [uri "/.git/config"] [unique_id "ajuCSv5G0wIIAaKHSFZGvAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇸🇬 securejdprop	2026-06-24 06:19:54 (2 weeks ago)	This IP was detected by CrowdSec triggering crowdsecurity/vpatch-CVE-2025-55182. WAF block: crowdsec ... show more This IP was detected by CrowdSec triggering crowdsecurity/vpatch-CVE-2025-55182. WAF block: crowdsecurity/vpatch-CVE-2025-55182 from 54.241.91.110 (172.22.0.5) show less	Hacking
🇮🇹 VHosting	2026-06-24 06:00:04 (2 weeks ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack

Showing 1 to 7 of 7 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇬 193.24.211.76

🇬🇧 198.244.226.112

🇧🇪 198.235.24.203

🇺🇿 194.107.115.199

🇮🇳 182.19.35.57

🇳🇱 91.92.40.124

🇸🇬 84.75.148.39

🇸🇬 84.75.148.35

🇺🇸 74.125.185.85

🇩🇪 69.5.169.70

🇱🇹 62.60.130.219

🇬🇧 51.195.183.17

🇻🇳 45.119.81.245

🇬🇧 35.203.211.96

🇧🇷 14.102.230.4

🇬🇧 198.244.242.145

🇬🇧 198.244.240.62

🇬🇧 198.244.240.7

🇧🇷 177.221.160.236

🇳🇬 165.154.11.206