51.195.91.161

Classification: Malicious

51.195.91.161 is a malicious IP address in Limburg an der Lahn, DE. 441 sightings from 12 threat sources (Port Scanner, HTTP Attacker), last seen 2026-10-11.

Current activity

  • Known attacker — Seen launching attacks over the Internet.
  • Known scanner — Seen scanning hosts over the Internet.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
HTTP Attacker AbuseIPDB 2026-06-19 15:19:11 2026-10-11 19:17:37 attacker malicious-activity
Port Scanner AbuseIPDB 2026-06-17 16:54:17 2026-10-11 15:00:56 attacker malicious-activity reconnaissance
Hacking AbuseIPDB 2026-06-19 15:19:11 2026-10-11 03:56:32 attacker malicious-activity
Malicious Host HoneyDB 2020-12-12 00:00:00 2026-10-11 00:00:00 attacker malicious-activity
HTTP Scrapper AbuseIPDB 2026-06-20 21:00:39 2026-10-10 21:37:04 attacker malicious-activity
DDoS Attacker AbuseIPDB 2026-08-30 17:46:39 2026-10-09 21:10:50 attacker malicious-activity
Phishing AbuseIPDB 2026-10-09 21:10:50 2026-10-09 21:10:50 malicious-activity phishing
Mail Spammer AbuseIPDB 2026-10-06 19:19:16 2026-10-06 19:19:16 attacker malicious-activity
Bruteforce AbuseIPDB 2026-06-18 23:21:09 2026-10-06 06:20:20 attacker malicious-activity
SSH Attacker AbuseIPDB 2026-08-29 12:55:54 2026-10-05 21:35:28 attacker malicious-activity
SQL Injection AbuseIPDB 2026-06-19 16:40:17 2026-10-03 04:38:37 attacker malicious-activity
Bruteforce login attacker Blocklist.de 2026-09-25 09:00:56 2026-09-26 09:00:42 attacker malicious-activity
HTTP Attacker Blocklist.de 2026-09-25 07:00:59 2026-09-26 07:01:01 attacker malicious-activity
Malicious Host AbuseIPDB 2026-08-25 19:17:35 2026-09-25 11:15:01 attacker compromised malicious-activity
HTTP Spammer StopForumSpam.com 2020-10-01 22:01:57 2021-01-26 20:28:06 malicious-activity
SIP Attacker Blocklist.de 2020-12-13 08:49:12 2020-12-14 08:12:44 malicious-activity
SSH Attacker Blocklist.de 2020-12-09 08:42:15 2020-12-12 10:23:28
Unsafe.AI_Score_86% Hybrid-Analysis 2020-12-01 05:30:15 2020-12-01 05:30:15
HTTP Spammer Sblam 2020-10-06 06:10:36 2020-11-30 08:06:02 malicious-activity
DDoS attack Blocklist.net.ua 2020-10-06 03:37:47 2020-11-06 08:27:17
ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic Emerging Threats 2020-09-29 05:03:21 2020-11-03 09:45:44 anonymization
ET TOR Known Tor Exit Node TCP Traffic Emerging Threats 2020-09-29 05:02:11 2020-11-03 09:44:34 anonymization
HTTP Spammer Cleantalk.org 2020-10-25 02:12:55 2020-10-25 08:40:23
HTTP Spammer Botscout 2020-10-21 01:43:16 2020-10-21 01:43:16
HTTP Spammer Myip.ms 2020-10-08 05:01:15 2020-10-08 05:01:15
TOR Exit Node TorProject.org 2020-09-27 05:40:45 2020-09-27 05:40:45

Tags

tor anonymizer bot abuse ssh bruteforce sip attacker apache ddos rfi login joomla wordpress

Whois information

AS name
AS16276 OVH SAS
AS registry
ripencc
AS date
1993-09-01 00:00:00
AS CIDR
51.195.0.0/16
CIDR
51.195.90.0/23
Registrant
OVH SAS
Address
Dudweiler Landstrasse 5 66123 Saarbrucken Deutschland
City
Limburg an der Lahn
Postal code
65550
Country
DE — Germany 🇩🇪
Contact email
[email protected]
First indexed
2020-09-27 05:40:45
Last updated
2026-10-13 12:13:00

Malicious IPs in the same CIDR

51.195.91.124 51.195.235.22 51.195.102.120 51.195.138.37 51.195.40.26 51.195.149.120 51.195.26.236 51.195.26.222 51.195.91.114 51.195.5.231 51.195.43.90 51.195.121.102 51.195.43.58 51.195.203.3 51.195.41.230 51.195.148.39 51.195.91.161 51.195.102.74 51.195.219.40 51.195.203.215 51.195.254.107 51.195.254.15 51.195.222.29 51.195.219.160 51.195.201.93