JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.254.224.241

54.254.224.241 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 78%: ?

78%

ISP	Amazon Data Services Japan
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16509
Hostname(s)	ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com
Domain Name	amazon.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.254.224.241

Whois 54.254.224.241

IP Abuse Reports for 54.254.224.241:

This IP address has been reported a total of 16 times from 13 distinct sources. 54.254.224.241 was first reported on July 24th 2026, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-07-28 05:20:40 (17 hours ago)	Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b ... show more Remote Command Execution: Unix Command Injection (command without evasion). Pattern match "(?i)(?:b (932235-195) show less	Hacking
🇩🇪 ger-stg-sifi1	2026-07-28 04:00:14 (19 hours ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇦🇹 penguin-solutions.at	2026-07-28 02:29:02 (20 hours ago)	Excessive 403/404 errors ...	Brute-Force Web App Attack
🇬🇧 Mendip_Defender	2026-07-27 10:35:59 (1 day ago)	54.254.224.241 - - [27/Jul/2026:11:35:52 +0100] "GET /test.php HTTP/1.1" 404 5526 "-" "Mozilla/5.0 ( ... show more 54.254.224.241 - - [27/Jul/2026:11:35:52 +0100] "GET /test.php HTTP/1.1" 404 5526 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.254.224.241 - - [27/Jul/2026:11:35:52 +0100] "GET /phpinfo HTTP/1.1" 404 6355 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 54.254.224.241 - - [27/Jul/2026:11:36:00 +0100] "GET /debug.php HTTP/1.1" 404 5526 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 09:42:44 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast ... show more (mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 05:42:39.297577 2026] [security2:error] [pid 3633920:tid 3633920] [client 54.254.224.241:56588] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mylesmitchell.com"] [uri "/.git/config"] [unique_id "amcoD6Gg6qDAd496Ro26AgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-27 02:42:40 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast ... show more (mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 22:42:33.908073 2026] [security2:error] [pid 3583128:tid 3583128] [client 54.254.224.241:47254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "instalatoribucuresti.com"] [uri "/.git/config"] [unique_id "ambFmStdizr00umM8JlXAwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Mangelot Hosting	2026-07-26 23:05:25 (2 days ago)	(modsecurity) srv104 ModSecurity 54.254.224.241 (SG/Singapore/ec2-54-254-224-241.ap-southeast-1.comp ... show more (modsecurity) srv104 ModSecurity 54.254.224.241 (SG/Singapore/ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com): 30 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: show less	Web App Attack
🇺🇸 Mundo Bueno	2026-07-26 02:34:35 (2 days ago)	[ISILIA Protection v2.1] Tentative d'accès: /.git/config \| Pays: SG \| UA: Mozilla/5.0 (Macintosh; In ... show more [ISILIA Protection v2.1] Tentative d'accès: /.git/config \| Pays: SG \| UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0. show less	Hacking Web App Attack
Anonymous	2026-07-24 21:23:27 (4 days ago)	(mod_security) mod_security triggered on hostname [redacted] 54.254.224.241 (SG/Singapore/ec2-54-254 ... show more (mod_security) mod_security triggered on hostname [redacted] 54.254.224.241 (SG/Singapore/ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com) show less	SQL Injection
🇩🇪 Gwyneth Llewelyn	2026-07-24 21:15:57 (4 days ago)	54.254.224.241 - - [24/Jul/2026:22:15:55 +0100] "GET /roundcube/.env.txt HTTP/2.0" 404 139 "-" "Mozi ... show more 54.254.224.241 - - [24/Jul/2026:22:15:55 +0100] "GET /roundcube/.env.txt HTTP/2.0" 404 139 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" show less	Bad Web Bot
🇳🇱 e.fierstra	2026-07-24 20:19:26 (4 days ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
Anonymous	2026-07-24 20:19:14 (4 days ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇩🇪 LRob	2026-07-24 17:31:11 (4 days ago)	CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5. ... show more CrowdSec: crowdsecurity/http-sensitive-files \| req: /.git/config \| 5 distinct paths \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Hacking
🇮🇹 VHosting	2026-07-24 17:30:05 (4 days ago)	Detected WordPress attack from 4 different servers	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-24 08:50:48 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast ... show more (mod_security) mod_security (id:210492) triggered by 54.254.224.241 (ec2-54-254-224-241.ap-southeast-1.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 04:50:40.681211 2026] [security2:error] [pid 4055411:tid 4055411] [client 54.254.224.241:56042] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webserviceswest.com"] [uri "/.git/config"] [unique_id "amMnYF8xAeGkQyLPG8dMVAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 172.184.210.240

🇳🇱 81.19.216.73

🇺🇸 162.216.150.173

🇦🇺 158.178.141.16

🇨🇳 139.210.169.141

🇹🇼 111.70.20.166

🇺🇸 65.110.40.43

🇳🇴 51.120.79.193

🇫🇷 51.38.224.114

🇬🇧 45.133.173.163

🇨🇳 36.104.144.114

🇬🇧 2.57.17.236

🇳🇱 195.178.110.227

🇸🇪 171.25.158.70

🇨🇳 114.218.57.21

🇨🇻 102.211.9.99

🇳🇱 88.151.33.203

🇧🇷 45.229.1.212

🇺🇸 35.172.91.99

🇩🇪 34.159.18.221