JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.168.30.15

170.168.30.15 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 19%: ?

19%

ISP	Fine Group Servers Solutions LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59651
Domain Name	finegroupservers.com
Country	🇸🇪 Sweden
City	Marsta, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.168.30.15

Whois 170.168.30.15

IP Abuse Reports for 170.168.30.15:

This IP address has been reported a total of 13 times from 5 distinct sources. 170.168.30.15 was first reported on December 10th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 librebit	2026-06-14 03:25:25 (1 day ago)	Brute force	Brute-Force
Anonymous	2026-06-06 10:06:05 (1 week ago)	Trying to access config files	Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 12:15:59 (1 month ago)	(mod_security) mod_security (id:210350) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:15:55.123968 2026] [security2:error] [pid 30130:tid 30130] [client 170.168.30.15:38523] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|southernislands.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "southernislands.com"] [uri "/"] [unique_id "agMZ-3XetMHdcqEpFGdcCwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-13 09:12:54 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 05:12:50.320370 2026] [security2:error] [pid 856083:tid 856083] [client 170.168.30.15:11703] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jolankagroup.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adyzkr9V5Yb5pkZ2qkY7ggAAAAk"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 02:45:26 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 170.168.30.15 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 22:45:21.334643 2026] [security2:error] [pid 4793:tid 4793] [client 170.168.30.15:63309] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|solidthought.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "solidthought.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac8pwRm-2AE3HiJaLQf06wAAAAo"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 SSH-Admin	2026-02-07 17:12:28 (4 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇫🇷 masterguru	2026-01-27 06:53:22 (4 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-25 05:28:10 (4 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-22 10:39:38 (4 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-19 20:53:52 (4 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-01-07 04:07:45 (5 months ago)	(modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the ... show more (modsec_5015) ModSec 5015: Suspicious User-Agent from 170.168.30.15 (NL/The Netherlands/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇨🇦 SSH-Admin	2025-12-27 13:45:08 (5 months ago)	Probing for Exploits	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2025-12-10 14:52:11 (6 months ago)	"Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized ac ... show more "Participant in large-scale DDoS Attack in which data injection was attmpted to gain unauthorized access" show less	DDoS Attack SQL Injection Exploited Host

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 204.14.109.144

🇲🇽 187.191.48.23

🇩🇪 165.154.138.3

🇺🇸 104.43.242.4

🇰🇷 211.116.107.222

🇨🇳 183.222.14.40

🇨🇴 179.32.33.161

🇵🇰 103.249.114.52

🇨🇦 96.1.40.151

🇳🇱 91.92.40.4

🇩🇪 69.5.169.202

🇺🇸 66.132.172.40

🇨🇦 20.220.147.44

🇨🇳 14.103.127.97

🇺🇦 2a06:6440:0:2c88::1

🇵🇭 222.127.76.40

🇧🇪 198.235.24.181

🇬🇪 195.54.179.244

🇨🇳 115.210.48.224

🇮🇹 103.252.221.163