AS16276 OVH SAS

Abuse reported against IP addresses announced by autonomous system 16276. If you run this network, the addresses below are a good place to start an abuse investigation.

In the last 30 days, 6,081 IP addresses in AS16276 OVH SAS were reported for abuse, in 18,219 reports altogether. 11 of them (0%) have a confidence score of 75 or more and are on the default blocklist. The most common reasons were Port Scan, Web Spam and Bad Web Bot. Most of them are in France.

6,081addresses reported, 30 days

11on the default blocklist (75+)

18,219reports against them

58 minsince the latest report

Most reported addresses

Address	Score	Reports	Categories	Last seen
🇬🇧51.195.149.120	86	28	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control	2 h
🇫🇷51.91.96.79	83	24	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇩🇪135.125.235.107	79	22	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇫🇷51.75.247.232	77	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇩🇪57.129.120.143	76	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇫🇷51.75.27.218	76	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇩🇪51.195.40.26	76	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇫🇷51.254.130.161	76	22	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	6 h
🇺🇸192.207.105.196	76	34	DNS Poisoning FTP Brute-Force Phishing VoIP Fraud Open Proxy Web Spam Email Spam Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Mail Server Attack Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	7 h
🇵🇱54.38.52.18	75	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇮🇹57.131.27.43	75	28	DNS Poisoning VoIP Fraud Web Spam Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	10 h
🇫🇷51.38.224.114	74	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇸🇬51.79.143.228	74	21	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	8 h
🇫🇷51.38.225.77	74	15	FTP Brute-Force Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Credential Stuffing Vulnerability Scan Command & Control	13 h
🇬🇧54.37.222.215	74	17	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	13 h
🇫🇷217.182.253.249	73	22	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇵🇱145.239.89.124	73	21	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇫🇷141.94.121.165	73	19	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	2 h
🇨🇦148.113.248.142	73	15	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	6 h
🇫🇷51.195.165.136	73	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	13 h

What they were reported for

Where they are

Block them

The blocklist holds every address with a confidence of 75 or more, in nine formats for firewalls, web servers and SIEMs. Download it with a free API key:

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"

See the integration guides for nginx, fail2ban, pfSense, MikroTik and more, or the API reference.

Figures cover the last 30 days and are refreshed hourly; last updated 19 minutes ago.