JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 57.131.131.18

57.131.131.18 was found in our database!

This IP was reported 66 times. Confidence of Abuse is 98%: ?

98%

ISP	OVH GmbH
Usage Type	Data Center/Web Hosting/Transit
ASN	AS16276
Hostname(s)	vps-019baf05.vps.ovh.net
Domain Name	ovh.net
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 57.131.131.18

Whois 57.131.131.18

IP Abuse Reports for 57.131.131.18:

This IP address has been reported a total of 66 times from 24 distinct sources. 57.131.131.18 was first reported on July 27th 2026, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 pinguin	2026-08-18 18:27:53 (4 hours ago)	Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from DE. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 Rip	2026-08-18 13:01:43 (9 hours ago)	403 Errors: Access Forbidden	Brute-Force
🇵🇱 Budyn	2026-08-17 17:41:45 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.ovh \| URI: / \| UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇦🇺 paulshipley.com.au	2026-08-17 12:20:21 (1 day ago)	[Mon Aug 17 22:20:20.369927 2026] [security2:error] [pid 109318] [client 57.131.131.18:49824] [clien ... show more [Mon Aug 17 22:20:20.369927 2026] [security2:error] [pid 109318] [client 57.131.131.18:49824] [client 57.131.131.18] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/"] [unique_id "aoL8hKRJ8S0qZm8AFkHCzAAAAAU"] ... show less	Web App Attack
🇨🇭 4server	2026-08-17 09:42:55 (1 day ago)	[MonAug1711:42:52.4201442026][security2:error][pid2870097:tid2870613][client57.131.131.18:0]ModSecur ... show more [MonAug1711:42:52.4201442026][security2:error][pid2870097:tid2870613][client57.131.131.18:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"brusmann.ch\"][uri\"/\"][unique_id\"aoLXnA5I_7xDLLhAJLjdUQAAAUw\"] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-08-17 08:32:30 (1 day ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: db.teddypot.website \| URI: / \| UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇵🇱 Budyn	2026-08-16 15:34:54 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.teddypot.website \| URI: / \| UA: Mozilla/5.0 (iPad; CPU OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.7922.57 Mobile/15E148 Safari/604.1 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇺🇸 Vianpyro	2026-08-16 07:11:23 (2 days ago)	Honeypot: 6 request(s) in 542 min. Paths: /. Method(s): GET. UA: Mozilla/5.0 (iPhone; CPU iPhone OS ... show more Honeypot: 6 request(s) in 542 min. Paths: /. Method(s): GET. UA: Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (K. ASN: 16276 (OVH GmbH). show less	Web App Attack Bad Web Bot
🇵🇱 Budyn	2026-08-15 22:37:24 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: db.teddypot.website \| URI: / \| UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇮🇳 nadnitin	2026-08-15 20:12:37 (3 days ago)	Automated trigger via Nginx Police. Reason: IP-SCANNER. Trigger Log: 57.131.131.18 - - [16/Aug/2026: ... show more Automated trigger via Nginx Police. Reason: IP-SCANNER. Trigger Log: 57.131.131.18 - - [16/Aug/2026:01:42:36 +0530] "GET / HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36" show less	Port Scan
🇩🇪 jbcrn	2026-08-15 15:51:36 (3 days ago)	Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ... show more Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 show less	Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-15 14:12:03 (3 days ago)	[SatAug1516:12:00.1932782026][security2:error][pid3308304:tid3308472][client57.131.131.18:0]ModSecur ... show more [SatAug1516:12:00.1932782026][security2:error][pid3308304:tid3308472][client57.131.131.18:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"serversvizzera.ch\"][uri\"/\"][unique_id\"aoBzsF45g695avzeKOmTIAAAAQU\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2026-08-15 09:42:39 (3 days ago)	apache vulnerability scan	Web App Attack
🇵🇱 Budyn	2026-08-15 07:23:59 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: docker.teddypot.website \| URI: / \| UA: Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
Anonymous	2026-08-15 03:40:18 (3 days ago)	IP banned by Fail2Ban in jail nginx-abusive-ips	Web App Attack Brute-Force Bad Web Bot

Showing 1 to 15 of 66 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 185.180.229.105

🇨🇦 184.151.88.27

🇨🇳 180.165.46.78

🇦🇷 138.204.158.15

🇭🇰 103.210.21.178

🇲🇽 68.155.154.146

🇺🇸 20.106.102.5

🇺🇸 20.65.194.84

🇨🇳 14.29.214.161

🇩🇪 213.209.159.26

🇺🇸 172.206.227.110

🇮🇳 168.144.30.105

🇮🇳 122.168.197.245

🇨🇳 112.27.230.157

🇳🇵 111.119.44.29

🇳🇱 34.90.14.69

🇩🇪 162.19.245.239

🇫🇷 89.92.128.214

🇺🇸 72.215.46.109

🇺🇸 71.27.86.44