JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 54.91.173.27

54.91.173.27 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 0%: ?

ISP	Amazon Data Services Northern Virginia
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14618
Hostname(s)	ec2-54-91-173-27.compute-1.amazonaws.com
Domain Name	amazon.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 54.91.173.27

Whois 54.91.173.27

IP Abuse Reports for 54.91.173.27:

This IP address has been reported a total of 56 times from 42 distinct sources. 54.91.173.27 was first reported on October 1st 2025, and the most recent report was 9 months ago.

Old Reports: The most recent abuse report for this IP address is from 9 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-10-04 03:46:13 (9 months ago)		Bad Web Bot
🇭🇺 DumaNet	2025-10-04 02:29:00 (9 months ago)	Web app attack attempts, scanning for vulnerability. Date: 2025 Oct 02. 16:38:58 Source IP: 54.91. ... show more Web app attack attempts, scanning for vulnerability. Date: 2025 Oct 02. 16:38:58 Source IP: 54.91.173.27 Portion of the log(s): 54.91.173.27 - [02/Oct/2025:16:38:42 +0200] "GET /awstats/.env HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" 54.91.173.27 - [02/Oct/2025:16:38:35 +0200] "GET /aws-secret.yaml HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" 54.91.173.27 - [02/Oct/2025:16:38:35 +0200] "GET /wp-config HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" 54.91.173.27 - [02/Oct/2025:16:38:18 +0200] "GET /_profiler/phpinfo/phpinfo.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" 54.91.173.27 - [02/Oct/2025:16:38:18 +0200] "GET /_profiler/phpinfo/info.php HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0".... show less	Web App Attack
🇳🇱 Site.eu	2025-10-03 05:12:46 (9 months ago)	Excessive 404/403 errors	Brute-Force
🇩🇪 Vegascosmetics	2025-10-02 21:50:14 (9 months ago)	Kingcopy(AI-IDS):IP does Multiple AWS Environment Abuse	Hacking Web App Attack
🇩🇪 LRob	2025-10-02 16:17:56 (9 months ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 16:15:49 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 12:15:41.865294 2025] [security2:error] [pid 26883:tid 26883] [client 54.91.173.27:35802] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blanchardch.fr"] [uri "/.env"] [unique_id "aN6lLbhjRk69lY3i1VrlfAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 zynex	2025-10-02 15:42:15 (9 months ago)	URL Probing: /.env	Web App Attack
🇫🇷 dynamix	2025-10-02 14:57:28 (9 months ago)	Multiple WAF Violations	Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 14:24:27 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 10:24:22.873879 2025] [security2:error] [pid 18134:tid 18134] [client 54.91.173.27:52464] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vetline.eu"] [uri "/.env"] [unique_id "aN6LFtFyYBwSN3BjjKkIDwAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 BlueWire Hosting	2025-10-02 14:10:12 (9 months ago)	Scanning for Laravel vulnerabilities	Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 13:58:06 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 09:58:01.330272 2025] [security2:error] [pid 21812:tid 21812] [client 54.91.173.27:45402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thedreamcatchers.eu"] [uri "/.env"] [unique_id "aN6E6SUpqtQT0HR16zjYRQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-02 13:27:44 (9 months ago)	54.91.173.27 - sliver85.eu - [02/Oct/2025:15:27:38 +0200] "GET / HTTP/1.1" 444 "-" 54.91.173.27 - sl ... show more 54.91.173.27 - sliver85.eu - [02/Oct/2025:15:27:38 +0200] "GET / HTTP/1.1" 444 "-" 54.91.173.27 - sliver85.eu - [02/Oct/2025:15:27:44 +0200] "GET / HTTP/1.1" 444 "-" ... show less	Brute-Force Web App Attack
🇩🇪 Jochen Pretli	2025-10-02 13:15:44 (9 months ago)	connection to honeypot	Email Spam Port Scan
🇩🇪 Roper123	2025-10-02 13:02:42 (9 months ago)	Web exploits	Web App Attack
🇺🇸 TPI-Abuse	2025-10-02 12:37:24 (9 months ago)	(mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazon ... show more (mod_security) mod_security (id:210492) triggered by 54.91.173.27 (ec2-54-91-173-27.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 08:37:21.430288 2025] [security2:error] [pid 15080:tid 15080] [client 54.91.173.27:59114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "polydorou.eu"] [uri "/.git/config"] [unique_id "aN5yAbOHmXLOAoIsL49wBQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.149.18

🇯🇵 160.251.169.213

🇺🇸 44.209.170.219

🇯🇵 20.210.160.218

🇧🇷 189.56.0.19

🇧🇷 186.192.215.5

🇯🇲 173.225.242.238

🇺🇸 162.243.30.173

🇺🇸 147.185.132.222

🇨🇳 111.62.173.90

🇸🇬 103.189.234.244

🇮🇳 98.70.50.166

🇺🇸 44.28.0.45

🇫🇷 85.217.140.20

🇺🇸 45.156.129.67

🇺🇸 44.81.110.148

🇳🇱 34.34.103.195

🇺🇸 206.217.128.7

🇧🇪 198.235.24.178

🇫🇮 147.185.133.175