JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 170.79.120.128

170.79.120.128 was found in our database!

This IP was reported 50 times. Confidence of Abuse is 100%: ?

100%

ISP	ANDERNET TELECOM LTDA - ME
Usage Type	Fixed Line ISP
ASN	AS266291
Domain Name	andernettelecom.net.br
Country	🇧🇷 Brazil
City	Sao Caitano, Pernambuco

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 170.79.120.128

Whois 170.79.120.128

IP Abuse Reports for 170.79.120.128:

This IP address has been reported a total of 50 times from 34 distinct sources. 170.79.120.128 was first reported on May 15th 2024, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 Burayot	2026-07-08 16:06:26 (4 hours ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 170.79.120.128 (BR/Brazil/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 170.79.120.128 (BR/Brazil/-): 1 in the last 3600 secs show less	Web App Attack
🇸🇪 EmK530	2026-07-08 05:13:46 (15 hours ago)	URL flagged by RegEx: /xmlrpc.php	Web App Attack
🇬🇧 andypiper	2026-07-08 01:02:12 (19 hours ago)	CrowdSec ban for AbuseIPDB Top List	Brute-Force Web App Attack
🇩🇪 4server	2026-07-08 00:12:31 (20 hours ago)	[WedJul0802:12:29.4880502026][security2:error][pid2011683:tid2011772][client170.79.120.128:0]ModSecu ... show more [WedJul0802:12:29.4880502026][security2:error][pid2011683:tid2011772][client170.79.120.128:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"admin-services.ch\"][uri\"/xmlrpc.php\"][unique_id\"ak2V7fqoPWYocp7Tb8LzswAAAJU\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Site.eu	2026-07-07 12:02:41 (1 day ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
Anonymous	2026-07-07 01:55:04 (1 day ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇩🇪 4server	2026-07-06 23:16:13 (1 day ago)	[TueJul0701:16:07.5948152026][security2:error][pid597166:tid597253][client170.79.120.128:0]ModSecuri ... show more [TueJul0701:16:07.5948152026][security2:error][pid597166:tid597253][client170.79.120.128:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"modularss.com\"][uri\"/xmlrpc.php\"][unique_id\"akw3N1Ps5jCO5J6ZMfzHZwAAAJI\"] show less	Port Scan Brute-Force Web App Attack
🇫🇷 Sklurk	2026-07-06 05:08:49 (2 days ago)	Web App Attack	Web App Attack
🇩🇪 4server	2026-07-05 14:04:14 (3 days ago)	[SunJul0516:04:09.0840492026][security2:error][pid2924282:tid2924345][client170.79.120.128:0]ModSecu ... show more [SunJul0516:04:09.0840492026][security2:error][pid2924282:tid2924345][client170.79.120.128:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"robertselitrenny.ch\"][uri\"/xmlrpc.php\"][unique_id\"akpkWfqbMpCJ1YsO1lfMkAAAAFQ\"] show less	Port Scan Brute-Force Web App Attack
🇪🇸 masterguru	2026-07-05 07:22:53 (3 days ago)	(xmlrpc) Failed xmlrpc access from 170.79.120.128 (BR/Brazil/-): 5 in the last 3600 secs (0-122)	Hacking
🇳🇱 wlt-blocker	2026-07-05 05:22:24 (3 days ago)	Unauthorized access to webpage admin	Web App Attack
🇫🇷 ELYAZ	2026-07-04 20:16:36 (3 days ago)	(wordpress) Failed wordpress login from 170.79.120.128 (BR/Brazil/-): (CF_ENABLE)	Brute-Force
🇳🇱 Site.eu	2026-07-04 01:28:02 (4 days ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-03 17:36:43 (5 days ago)	(mod_security) mod_security (id:225170) triggered by 170.79.120.128 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:225170) triggered by 170.79.120.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 13:36:40.403462 2026] [security2:error] [pid 22901:tid 22901] [client 170.79.120.128:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|rodrigoaldecoa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rodrigoaldecoa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "akfzKGZgZC6Ggy2u6koUPQAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 chronos	2026-07-03 11:34:17 (5 days ago)	[AUTORAVALT][[03/07/2026 - 08:34:17 -03:00 UTC] Attack from [Latin American and Caribbean IP address ... show more [AUTORAVALT][[03/07/2026 - 08:34:17 -03:00 UTC] Attack from [Latin American and Caribbean IP address Regional Registry] [170.79.120.128] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, p] ... show less	Hacking Web App Attack

Showing 1 to 15 of 50 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.205

🇮🇶 37.239.136.107

🇺🇸 192.18.143.53

🇺🇸 172.253.249.49

🇨🇳 120.82.64.51

🇱🇹 62.60.130.219

🇩🇪 51.89.38.59

🇳🇱 45.148.10.152

🇰🇷 222.232.201.44

🇳🇱 195.178.110.227

🇺🇸 172.233.219.44

🇺🇸 172.217.46.23

🇨🇳 113.200.216.246

🇺🇸 104.171.28.60

🇻🇳 103.167.89.222

🇺🇸 185.236.200.244

🇺🇸 172.58.125.246

🇭🇺 185.225.69.187

🇺🇸 172.172.131.149

🇺🇸 172.70.206.46