There is nothing to be concerned about with this as it commonly shows up with secured applications on the internet. A user accesses a link through their bookmarks bar or through their browser history to go back to a page that they want to go back to and because their session has expired they are redirected to the login page to login first. No worries here.
Update #1 Further investigations into the IP in question have shown the following points...
- The IP adress has been detected through project honeypot but was classed as possibly a harmless web crawler as none of the IP's visits have caused any problems. http://www.projecthoneypot.org/ip_54.209.60.63
- Some users on the AbuseIP database report that removing the Web of Trust has resulted in the connections stopping however this can not be verified as the connections are being made against web servers not web browsers and WoT uses human ratings to rate websites.
https://www.abuseipdb.com/check/54.209.60.63
https://www.mywot.com/en/support/how-wot-works - The IP has been listed on the BadIP's website as a malicious website as March 2015. https://www.badips.com/info/54.209.60.63
Based on the fact that none of these abuse reports about the IP address 54.209.60.63 actually state that anything malicious was done to the web server and even Project Honeypot confirms it is a possible web crawler and not a malicious machine there should be no concern.
The IP address has also since been de-activated from the offending account with Amazon and is no longer assigned to the original EC2 instance in question so there should be no further issues from this IP address regardless.