JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 137.131.59.254

137.131.59.254 was found in our database!

This IP was reported 5 times. Confidence of Abuse is 28%: ?

28%

ISP	Oracle Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS31898
Domain Name	oracle.com
Country	🇺🇸 United States of America
City	Phoenix, Arizona

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 137.131.59.254

Whois 137.131.59.254

IP Abuse Reports for 137.131.59.254:

This IP address has been reported a total of 5 times from 4 distinct sources. 137.131.59.254 was first reported on September 8th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 backslash	2026-09-19 00:12:02 (1 day ago)	block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8	Bad Web Bot
🇫🇷 LRob	2026-09-10 21:07:55 (1 week ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: / \| 2026-09-10 21:07 UTC show less	Bad Web Bot
🇩🇪 conseilgouz	2026-09-10 18:06:46 (1 week ago)	avw-Joomla User : try to access forms...	Hacking
🇩🇪 LRob	2026-09-10 17:21:12 (1 week ago)	Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ... show more Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for \| method: GET \| path: /nos-metiers/plafonds-suspendus \| 2026-09-10 17:21 UTC show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-08 15:45:54 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 137.131.59.254 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 137.131.59.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 11:45:48.723990 2026] [security2:error] [pid 15806:tid 15806] [client 137.131.59.254:63442] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.artfranz.com\|F\|2"] [data ".willowriver3.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.artfranz.com"] [uri "/webdesign/http/:www.willowriver3.com"] [unique_id "aqAtrH_Hc3EGR2QyyFLPVwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 5 of 5 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.69

🇳🇱 185.242.226.166

🇺🇸 162.216.149.226

🇳🇱 160.119.76.138

🇨🇳 125.46.130.236

🇨🇳 122.144.198.22

🇻🇳 103.82.21.8

🇵🇱 87.251.64.131

🇵🇱 87.251.64.129

🇩🇪 65.111.26.202

🇸🇬 136.110.59.227

🇨🇳 119.189.6.200

🇨🇳 114.116.243.181

🇺🇸 109.105.209.5

🇺🇸 109.105.209.4

🇺🇸 109.105.209.3

🇫🇮 80.66.83.43

🇭🇰 69.33.212.173

🇩🇪 69.5.169.104

🇩🇪 69.5.169.98