JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.251.1.49

54.251.1.49 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 0%: ?

ISP	Amazon.com, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-251-1-49.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.251.1.49

Whois 54.251.1.49

IP Abuse Reports for 54.251.1.49:

This IP address has been reported a total of 11 times from 5 distinct sources. 54.251.1.49 was first reported on October 3rd 2022, and the most recent report was 7 months ago.

Old Reports: The most recent abuse report for this IP address is from 7 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2025-12-17 09:49:23 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.com ... show more (mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 17 04:49:16.354115 2025] [security2:error] [pid 5330:tid 5330] [client 54.251.1.49:54170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chopstickhouseevansville.com"] [uri "/.git/config"] [unique_id "aUJ8nNM-2IjYZvxJQdhg3AAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-12-17 09:29:33 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.com ... show more (mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 17 04:29:28.458476 2025] [security2:error] [pid 19567:tid 19567] [client 54.251.1.49:35022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chinakingdom.hk"] [uri "/.git/config"] [unique_id "aUJ3-HDH5ZYBtlKWpAef-wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Hydra-Shield.fr	2025-12-17 08:49:58 (7 months ago)	Directory Traversal on: /.git/config	Web App Attack
🇺🇸 TPI-Abuse	2025-12-17 07:56:37 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.com ... show more (mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 17 02:56:31.221715 2025] [security2:error] [pid 13456:tid 13456] [client 54.251.1.49:47650] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "champschallenge.org"] [uri "/.git/config"] [unique_id "aUJiLw9doKvUO3zD7WCUMwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2025-11-29 23:04:13 (7 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2025-11-28. show less	Hacking Web App Attack SSH
🇳🇱 homeshowdomain.nl	2025-11-28 23:01:56 (7 months ago)	Auto-ban: >3000 req/min op 2025-11-28	Hacking Web App Attack SSH
🇲🇾 Rizzy	2025-11-28 14:31:00 (7 months ago)	Multiple WAF Violations	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2025-11-28 14:02:09 (7 months ago)	(mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.com ... show more (mod_security) mod_security (id:210492) triggered by 54.251.1.49 (ec2-54-251-1-49.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 28 09:02:01.815638 2025] [security2:error] [pid 7841:tid 7841] [client 54.251.1.49:59364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americanacademyofteachersofsinging.org"] [uri "/.env"] [unique_id "aSmrWTaHkIbI7BfudpTSKQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Spidrweb.co.uk	2022-10-06 15:55:33 (3 years ago)	54.251.1.49 - - [06/Oct/2022:19:51:01 +0000] "POST /wp-login.php HTTP/1.1" 403 472 "-" "Mozilla/5.0 ... show more 54.251.1.49 - - [06/Oct/2022:19:51:01 +0000] "POST /wp-login.php HTTP/1.1" 403 472 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36 X-Middleton/1" 54.251.1.49 - - [06/Oct/2022:20:29:12 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" 54.251.1.49 - - [06/Oct/2022:20:30:14 +0000] "POST /wp-login.php HTTP/1.1" 403 472 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" ... show less	Brute-Force Web App Attack
🇺🇸 Spidrweb.co.uk	2022-10-05 14:27:49 (3 years ago)	54.251.1.49 - - [05/Oct/2022:18:53:40 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (c ... show more 54.251.1.49 - - [05/Oct/2022:18:53:40 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" 54.251.1.49 - - [05/Oct/2022:18:54:53 +0000] "POST /wp-login.php HTTP/1.1" 403 472 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" 54.251.1.49 - - [05/Oct/2022:19:01:49 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" ... show less	Brute-Force Web App Attack
🇺🇸 Spidrweb.co.uk	2022-10-03 13:54:21 (3 years ago)	54.251.1.49 - - [03/Oct/2022:18:22:58 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (c ... show more 54.251.1.49 - - [03/Oct/2022:18:22:58 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" 54.251.1.49 - - [03/Oct/2022:18:25:00 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" 54.251.1.49 - - [03/Oct/2022:18:27:02 +0000] "POST /xmlrpc.php HTTP/1.1" 403 177 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) X-Middleton/1" ... show less	Brute-Force Web App Attack

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.69

🇸🇬 178.128.212.46

🇨🇴 186.82.87.178

🇳🇱 176.65.148.242

🇺🇸 66.132.195.60

🇺🇸 66.132.186.179

🇹🇼 61.220.94.159

🇩🇪 46.224.164.125

🇫🇷 37.66.192.176

🇨🇳 14.103.111.16

🇷🇴 2.57.121.112

🇵🇱 176.53.159.198

🇵🇱 176.53.159.197

🇺🇸 147.185.132.57

🇺🇸 66.132.186.232

🇨🇳 221.210.2.146

🇺🇸 209.141.18.69

🇺🇸 205.210.31.110

🇧🇷 181.232.209.88

🇺🇸 147.185.132.123