JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 57.131.131.18

57.131.131.18 was found in our database!

This IP was reported 84 times. Confidence of Abuse is 100%: ?

100%

ISP	OVH GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	vps-019baf05.vps.ovh.net
Domain Name	ovh.net
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 57.131.131.18

Whois 57.131.131.18

IP Abuse Reports for 57.131.131.18:

This IP address has been reported a total of 84 times from 32 distinct sources. 57.131.131.18 was first reported on July 27th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 miszterx.hu	2026-08-22 18:57:13 (4 hours ago)	XORP (haproxy): 7x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_ipt ... show more XORP (haproxy): 7x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu) show less	Web App Attack
🇨🇭 4server	2026-08-22 16:30:32 (6 hours ago)	[SatAug2218:30:27.3371352026][security2:error][pid3204159:tid3204518][client57.131.131.18:0]ModSecur ... show more [SatAug2218:30:27.3371352026][security2:error][pid3204159:tid3204518][client57.131.131.18:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"xn--sanierung-alter-huser-m2b.ch\"][uri\"/\"][unique_id\"aonOox2KbgxVV04DwBTGHQAAAVY\"] show less	Hacking Web App Attack
🇵🇱 Roper123	2026-08-22 13:08:21 (9 hours ago)	Web app exploits	Web App Attack
🇭🇷 bubausluge	2026-08-22 04:39:15 (18 hours ago)	Blocked by https://aegis.hr — WAF: ModSec rule match - (MITRE T1190), 1 attempts, Period: 2026-08-22 ... show more Blocked by https://aegis.hr — WAF: ModSec rule match - (MITRE T1190), 1 attempts, Period: 2026-08-22 04:22:30 to 2026-08-22 04:22:30 show less	Web App Attack Hacking
🇪🇸 tutaim.com	2026-08-22 01:00:04 (21 hours ago)	⛔ [22/08/26] This IP has been detected performing multiple attacks on websites (3 attempts blocked). ... show more ⛔ [22/08/26] This IP has been detected performing multiple attacks on websites (3 attempts blocked). Potential malicious activity. show less	Brute-Force SSH Web App Attack FTP Brute-Force
🇦🇺 paulshipley.com.au	2026-08-21 21:06:55 (1 day ago)	[Sat Aug 22 07:06:54.967724 2026] [security2:error] [pid 206573] [client 57.131.131.18:33358] [clien ... show more [Sat Aug 22 07:06:54.967724 2026] [security2:error] [pid 206573] [client 57.131.131.18:33358] [client 57.131.131.18] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/"] [unique_id "aoi97oOPzOMHLz6mvCgLagAAAAA"] ... show less	Web App Attack
🇦🇺 paulshipley.com.au	2026-08-21 20:37:01 (1 day ago)	[Sat Aug 22 06:36:59.932379 2026] [security2:error] [pid 192313] [client 57.131.131.18:53110] [clien ... show more [Sat Aug 22 06:36:59.932379 2026] [security2:error] [pid 192313] [client 57.131.131.18:53110] [client 57.131.131.18] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/"] [unique_id "aoi260OzYLVGBK5oKcNIIwAAAAk"] ... show less	Web App Attack
Anonymous	2026-08-21 20:20:06 (1 day ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot
🇺🇸 MPL	2026-08-21 11:01:40 (1 day ago)	tcp/443 (16 or more attempts)	Port Scan
🇮🇩 Burayot	2026-08-21 06:53:04 (1 day ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 57.131.131.18 (FR/France/vps-019baf0 ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 57.131.131.18 (FR/France/vps-019baf05.vps.ovh.net): 1 in the last 3600 secs show less	Web App Attack
🇬🇧 andypiper	2026-08-21 01:01:21 (1 day ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇦🇺 paulshipley.com.au	2026-08-21 00:13:31 (1 day ago)	[Fri Aug 21 10:13:30.154860 2026] [security2:error] [pid 76208] [client 57.131.131.18:58878] [client ... show more [Fri Aug 21 10:13:30.154860 2026] [security2:error] [pid 76208] [client 57.131.131.18:58878] [client 57.131.131.18] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "iaki.com.au"] [uri "/"] [unique_id "aoeYKqpgIHnyldfJLxGRbQAAAAg"] ... show less	Web App Attack
Anonymous	2026-08-20 09:57:21 (2 days ago)	Fail2ban Nginx log integration.	Brute-Force SSH Port Scan
🇵🇱 Budyn	2026-08-20 06:40:06 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.teddypot.website \| URI: / \| UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇩🇪 4server	2026-08-19 20:19:05 (3 days ago)	[WedAug1922:19:03.2123092026][security2:error][pid2898072:tid2898148][client57.131.131.18:0]ModSecur ... show more [WedAug1922:19:03.2123092026][security2:error][pid2898072:tid2898148][client57.131.131.18:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"restaurantgandria.ch\"][uri\"/\"][unique_id\"aoYPt9oAkAMzA-0C_DUpeQAAAI8\"] show less	Port Scan Brute-Force Web App Attack

Showing 1 to 15 of 84 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4001:c6a::12e

🇺🇸 216.132.188.75

🇬🇧 193.163.125.183

🇺🇸 91.230.168.122

🇲🇦 81.192.46.32

🇱🇹 62.60.130.242

🇧🇪 198.235.24.214

🇳🇱 195.178.110.218

🇺🇸 154.16.115.33

🇪🇸 90.169.214.82

🇯🇵 43.165.185.177

🇨🇦 24.85.200.177

🇱🇹 213.176.26.94

🇫🇷 173.249.52.138

🇺🇸 152.163.165.137

🇹🇭 118.193.56.235

🇷🇴 66.179.29.16

🇳🇱 45.148.10.230

🇷🇴 213.173.98.24

🇳🇱 193.47.62.69