JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.168.243.248

170.168.243.248 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 37%: ?

37%

ISP	Fine Group Servers Solutions LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59651
Domain Name	finegroupservers.com
Country	🇫🇮 Finland
City	Vantaa, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.168.243.248

Whois 170.168.243.248

IP Abuse Reports for 170.168.243.248:

This IP address has been reported a total of 22 times from 13 distinct sources. 170.168.243.248 was first reported on November 21st 2025, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 Saec	2026-06-05 18:45:07 (13 hours ago)	Jarvis auto-ban: CF honeypot path /wp-login.php (2× on saec.me)	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-05-31 15:00:54 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 170.168.243.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 170.168.243.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 11:00:50.678805 2026] [security2:error] [pid 27759:tid 27759] [client 170.168.243.248:28637] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|bryanbender.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bryanbender.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahxNItVHVYLZRGf8DJzMbAAAAAQ"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-05-22 01:32:42 (2 weeks ago)	507 requests with url.path .git/	Brute-Force Bad Web Bot
🇫🇷 tilellit.pro	2026-05-21 20:56:01 (2 weeks ago)	Fail2Ban banned 170.168.243.248 for security violations in jail wp-armour. Log: 2026/05/21 20:56:00 ... show more Fail2Ban banned 170.168.243.248 for security violations in jail wp-armour. Log: 2026/05/21 20:56:00 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 170.168.243.248 \| Target: wplogin" , client: 170.168.243.248, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
🇫🇮 inlink.ltd	2026-05-20 08:07:19 (2 weeks ago)	Known malicious PHP file or CMS probe	Web App Attack
🇺🇸 octageeks.com	2026-05-20 04:06:27 (2 weeks ago)	Wordpress malicious attack:[octawp]	Web App Attack
🇺🇸 TPI-Abuse	2026-05-13 21:11:10 (3 weeks ago)	(mod_security) mod_security (id:211030) triggered by 170.168.243.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:211030) triggered by 170.168.243.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 17:11:05.314313 2026] [security2:error] [pid 12792:tid 12792] [client 170.168.243.248:49223] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at ARGS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "17"] [id "211030"] [rev "3"] [msg "COMODO WAF: LDAP Injection Attack\|\|www.genesis-castle.com\|F\|2"] [data "Matched Data: (%'%~%'%\|%\|%( found within ARGS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "www.genesis-castle.com"] [uri "/gallery/index.php"] [unique_id "agTo6VAkAhb5tSKLI0vUTQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 [email protected]	2026-05-04 19:41:36 (1 month ago)	[Mon May 04 21:41:36.399536 2026] [authz_core:error] [pid 1616931:tid 1616959] [remote 170.168.243.2 ... show more [Mon May 04 21:41:36.399536 2026] [authz_core:error] [pid 1616931:tid 1616959] [remote 170.168.243.248:23945] AH01630: client denied by server configuration: /var/www/html/MyWeb/Wordpress_www/xmlrpc.php ... show less	Brute-Force Web App Attack
🇫🇷 tilellit.pro	2026-05-02 19:10:13 (1 month ago)	Fail2Ban banned 170.168.243.248 for security violations in jail wp-armour. Log: 2026/05/02 19:10:12 ... show more Fail2Ban banned 170.168.243.248 for security violations in jail wp-armour. Log: 2026/05/02 19:10:12 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 170.168.243.248 \| Target: wplogin" , client: 170.168.243.248, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less	Web Spam
🇩🇪 LRob.fr	2026-04-13 16:00:18 (1 month ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
Anonymous	2026-04-03 07:07:48 (2 months ago)	Forum/form spam	Web Spam
🇫🇷 masterguru	2026-02-19 07:33:10 (3 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last 3600 secs (0-196) show less	Hacking
🇫🇷 masterguru	2026-02-19 02:43:52 (3 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last 3600 secs (0-195) show less	Hacking
Anonymous	2026-02-12 13:37:01 (3 months ago)	wordpress-trap	Web App Attack
🇫🇷 masterguru	2026-02-12 11:59:42 (3 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.243.248 (DE/Germany/-): 1 in the last 3600 secs (0-197) show less	Hacking

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a06:4880:2000::45

🇺🇸 2607:f8b0:4001:c0f::12d

🇬🇧 193.176.29.24

🇿🇦 185.132.186.26

🇨🇳 180.111.30.12

🇨🇳 122.97.209.248

🇨🇦 104.28.161.116

🇪🇸 88.98.108.206

🇩🇪 87.106.26.63

🇧🇬 79.124.62.134

🇩🇪 69.5.169.200

🇩🇪 69.5.169.172

🇺🇸 47.251.119.40

🇭🇰 47.83.235.47

🇧🇷 45.205.1.243

🇨🇳 42.85.103.65

🇻🇪 38.3.195.67

🇬🇧 31.14.254.41

🇨🇳 223.91.13.1

🇬🇧 217.146.80.116