JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.246.248.27

170.246.248.27 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 58%: ?

58%

ISP	Gcu Serviços de Provedor Ltda
Usage Type	Fixed Line ISP
ASN	AS61870
Domain Name	gcu.com.br
Country	🇧🇷 Brazil
City	Guaraniacu, Parana

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.246.248.27

Whois 170.246.248.27

IP Abuse Reports for 170.246.248.27:

This IP address has been reported a total of 12 times from 10 distinct sources. 170.246.248.27 was first reported on November 24th 2025, and the most recent report was 19 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 bigwavedave	2026-07-10 00:11:06 (19 hours ago)	Wordpress Attack	Web App Attack
🇺🇸 jcbriar	2026-07-09 23:36:33 (19 hours ago)	Searching for vulnerable scripts	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 11:30:53 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 07:30:46.341796 2026] [security2:error] [pid 6253:tid 6253] [client 170.246.248.27:26499] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|carolinafootprints.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "carolinafootprints.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak-GZr-eG0Fw7HQfcquPeQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 22:29:21 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:29:17.751486 2026] [security2:error] [pid 20982:tid 20982] [client 170.246.248.27:26785] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|iee-usa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iee-usa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak7PPc1ELyIzOMmRseyLywAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-07-08 22:00:53 (1 day ago)	Try to access /xmlrpc.php	Web App Attack
🇫🇮 stinpriza	2026-07-08 21:23:44 (1 day ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 17:15:19 (2 days ago)	(mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 170.246.248.27 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 13:14:58.939543 2026] [security2:error] [pid 9105:tid 9105] [client 170.246.248.27:27479] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|broneksuchanek.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "broneksuchanek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak6Fkt68BnpTunH3S-u--AAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 Yepngo	2026-07-08 14:50:27 (2 days ago)	170.246.248.27 - - [08/Jul/2026:16:43:57 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 ... show more 170.246.248.27 - - [08/Jul/2026:16:43:57 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" 170.246.248.27 - - [08/Jul/2026:16:50:26 +0200] "POST /xmlrpc.php HTTP/2.0" 200 410 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/87.0.0.0 Safari/537.36" ... show less	Brute-Force Web App Attack
🇳🇱 Joop	2026-07-07 16:26:14 (3 days ago)	2026-07-07 18:26:11 +0200 s2 /xmlrpc.php	Web App Attack
🇳🇿 Tripwire	2026-07-07 10:30:58 (3 days ago)	Probing for Wordpress - /xmlrpc.php	Brute-Force Web App Attack
🇧🇾 lns.bz	2026-07-07 06:26:29 (3 days ago)	Banned for trying to access xmlrpc [BY]	Web App Attack
Anonymous	2025-11-24 17:43:44 (7 months ago)	scanning http requests from known botnet	Web App Attack

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.73.216.250

🇧🇷 201.81.0.27

🇮🇹 79.40.163.73

🇫🇮 74.125.74.150

🇩🇪 69.5.169.236

🇺🇸 43.225.189.137

🇬🇧 35.203.210.142

🇰🇿 5.180.42.23

🇻🇳 183.91.186.36

🇺🇸 146.190.63.48

🇧🇩 103.112.54.86

🇸🇬 47.84.188.3

🇳🇱 45.198.224.60

🇺🇸 43.130.60.195

🇺🇸 31.58.50.100

🇴🇲 5.32.252.156

🇬🇧 2.57.17.47

🇨🇳 222.71.230.141

🇹🇼 221.120.78.177

🇺🇸 174.35.25.181