JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 64.131.81.242

64.131.81.242 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 71%: ?

71%

ISP	Leaseweb USA, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS30633
Hostname(s)	vps.metrodcforsale.com
Domain Name	leaseweb.com
Country	🇺🇸 United States of America
City	Centreville, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 64.131.81.242

Whois 64.131.81.242

IP Abuse Reports for 64.131.81.242:

This IP address has been reported a total of 31 times from 21 distinct sources. 64.131.81.242 was first reported on June 4th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-06-23 15:50:23 (1 week ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-06-17 12:26:57 (2 weeks ago)	Web vulnerability probing: /.env (bogus vhost/SNI)	Web App Attack
🇩🇪 ghostwarriors	2026-06-17 10:20:14 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇬🇧 OptimusGO	2026-06-17 07:39:48 (2 weeks ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-06-17 08:39:48 UTC Log evidence: 06/17/2026-08:39:47.756192 [] [1:1000103:1] SECURITY Management Port Probe - CRITICAL [] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 64.131.81.242:39054 -> 185.127.18.66:8443 show less	Port Scan Brute-Force
🇹🇭 Sawasdee	2026-06-17 03:48:07 (2 weeks ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
🇺🇸 RAP	2026-06-17 03:31:12 (2 weeks ago)	2026-06-17 03:31:12 UTC Unauthorized activity to TCP port 8443. Web App	Port Scan Web App Attack
🇺🇸 Axel	2026-06-16 17:55:21 (2 weeks ago)	Blocked by UFW on MVI [2087/tcp] \| SPT: 36834 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [2087/tcp] \| SPT: 36834 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇯🇵 S.O.B.A. Dev.	2026-06-14 22:39:11 (2 weeks ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇺🇸 Axel	2026-06-14 21:53:41 (2 weeks ago)	Blocked by UFW on MVI [2087/tcp] \| SPT: 35376 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [2087/tcp] \| SPT: 35376 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 deskpass.com	2026-06-13 15:02:15 (2 weeks ago)	GET /wp-config.php	Web App Attack
🇺🇸 TPI-Abuse	2026-06-13 05:44:47 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 64.131.81.242 (vps.metrodcforsale.com): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 64.131.81.242 (vps.metrodcforsale.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 01:44:41.253422 2026] [security2:error] [pid 14640:tid 14651] [client 64.131.81.242:47754] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.86"] [uri "/.git/HEAD"] [unique_id "aizuSccqBJuzcDTbjDjgOgAAAEI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Axel	2026-06-13 05:16:58 (2 weeks ago)	Blocked by UFW on MVI [8443/tcp] \| SPT: 53570 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github. ... show more Blocked by UFW on MVI [8443/tcp] \| SPT: 53570 \| TTL: 54 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-06-10 19:23:28 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 64.131.81.242 (vps.metrodcforsale.com): 1 in th ... show more (mod_security) mod_security (id:210492) triggered by 64.131.81.242 (vps.metrodcforsale.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 15:23:22.811924 2026] [security2:error] [pid 18051:tid 18051] [client 64.131.81.242:48676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.10"] [uri "/.git/HEAD"] [unique_id "aim5qnYmChEZfZHNHejYkwAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 RAP	2026-06-10 11:05:01 (3 weeks ago)	2026-06-10 11:05:01 UTC Unauthorized activity to TCP port 8443. Web App	Port Scan Web App Attack
🇷🇸 Smel	2026-06-10 10:00:23 (3 weeks ago)	MH/MP Probe, Scan, Hack -	Port Scan Hacking

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.90.244.27

🇺🇸 162.214.22.174

🇭🇰 150.5.131.119

🇭🇰 43.155.40.91

🇺🇸 2620:0:cc8::28

🇨🇳 183.184.54.135

🇸🇬 145.223.130.113

🇺🇸 135.237.125.109

🇳🇱 77.83.39.42

🇭🇰 65.181.88.245

🇻🇳 203.205.37.233

🇨🇳 180.139.127.11

🇺🇸 172.174.211.225

🇺🇸 164.90.156.35

🇸🇬 121.6.96.191

🇨🇳 117.72.212.5

🇻🇳 103.154.176.224

🇰🇪 102.210.148.41

🇻🇳 210.245.20.230

🇸🇬 145.223.131.65