57.131.130.172
Classification: Malicious
57.131.130.172 is a malicious IP address in Limburg an der Lahn, DE. 91 sightings from 3 threat sources (TOR Node), last seen 2026-11-07. Seen in 9 countries.
Current activity
- TOR node — Part of the TOR anonymization network.
Where it has been seen
Observed by Maltiverse Threat Observatory sensors in BR, CL, CO, EC, HN, MX, PE and US and 1 more countries, across education, energy, financial services, government, healthcare and manufacturing networks.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| TOR Node | Maltiverse Threat Observatory | 2026-10-02 08:05:15 | 2026-11-07 05:05:21 | anonymization country_code:br country_code:cl country_code:co country_code:ec country_code:hn country_code:mx country_code:pe country_code:us country_code:ve industry:education-and-nonprofits industry:energy-and-utilities industry:financial-services industry:government-and-public-sector industry:healthcare-and-pharmaceutical industry:manufacturing industry:technology-and-telecommunications malicious-activity tor | |
| ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic | Emerging Threats | 2026-09-26 11:03:00 | 2026-11-03 13:02:49 | anomalous-activity anonymization tor | |
| Anonymizer | FireHOL | 2026-09-24 17:56:08 | 2026-09-24 17:56:08 | anomalous-activity anonymization |
Tags
anonymization tor port:9000 port:9300 port:9100 port:9200Whois information
- AS name
- AS16276 OVH SAS
- Registrant
- OVH SAS
- City
- Limburg an der Lahn
- Postal code
- 65550
- Country
- DE — Germany 🇩🇪
- First indexed
- 2026-09-24 17:56:08
- Last updated
- 2026-11-07 05:47:17