JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 178.20.29.198

178.20.29.198 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 18%: ?

18%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS59651
Domain Name	finegroupservers.com
Country	🇫🇮 Finland
City	Helsinki, Uusimaa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 178.20.29.198

Whois 178.20.29.198

IP Abuse Reports for 178.20.29.198:

This IP address has been reported a total of 13 times from 11 distinct sources. 178.20.29.198 was first reported on September 29th 2022, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-07 23:45:36 (4 days ago)	(mod_security) mod_security (id:225170) triggered by 178.20.29.198 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.29.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 19:45:30.726750 2026] [security2:error] [pid 22994:tid 22994] [client 178.20.29.198:35985] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|dudleyanddudley.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dudleyanddudley.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aiYCmgqEvpkC823zV668HAAAABA"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob.fr	2026-05-26 17:15:16 (2 weeks ago)	WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail	Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 10:31:06 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 178.20.29.198 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.29.198 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 06:30:59.956659 2026] [security2:error] [pid 30217:tid 30217] [client 178.20.29.198:31265] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|firstunitedreserve.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "firstunitedreserve.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahQk4yb3fT_Lkvkg2DrrOQAAAAo"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-05 02:52:10 (1 month ago)	Fail2ban filtered ...	Web App Attack
🇩🇪 stinpriza	2026-03-19 15:30:14 (2 months ago)	Web App Attack	Web App Attack
🇩🇪 LRob.fr	2026-03-19 05:30:16 (2 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇺🇸 octageeks.com	2026-03-19 04:13:06 (2 months ago)	Wordpress malicious attack:[octaxmlrpc]	Web App Attack
🇺🇸 myagent.site	2026-03-18 07:11:26 (2 months ago)	Blocking for trying to access an exploit file: /xmlrpc.php	Hacking
🇩🇪 big-cloud.nl	2026-03-18 05:45:34 (2 months ago)	Try to access /xmlrpc.php	Web App Attack
🇬🇧 relianoid.com	2025-12-19 14:45:50 (5 months ago)	POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com	Web Spam
🇮🇩 BPS-StatisticsIndonesia	2024-12-15 21:11:12 (1 year ago)	WP Login Scan Activities	Web App Attack
🇩🇪 Packets-Decreaser.NET	2024-02-01 04:58:58 (2 years ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇯🇵 HeliJP	2022-09-29 11:20:02 (3 years ago)	2022-09-29 11:34:04 - Recognized attacks\bad behavior from IP address 178.20.29.198 on port 443\80 ( ... show more 2022-09-29 11:34:04 - Recognized attacks\bad behavior from IP address 178.20.29.198 on port 443\80 (74 daily hits): Remote Command Execution: Windows Command Injection, Remote Command Execution: Wildcard bypass technique attempt, RCE Bypass Technique, PHP Injection Attack: High-Risk PHP Function Call Found, PHP Injection Attack: Variable Function Call Found, IE XSS Filters - Attack Detected, SQL Injection Attack Detected via libinjection, SQL Injection Attack: SQL Operator Detected, SQL Injection Attack: SQL Tautology Detected, SQL Injection Attack, Detects MySQL comments, conditions and ch(a)r injections, Detects chained SQL injection attempts 2/2, Detects basic SQL injection based on keyword alter or union, Detects classic SQL injection probings 2/3, Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12), SQL Comment Sequence Detected, SQL Hex Encoding Identified show less	Hacking SQL Injection Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.153.34.71

🇮🇳 217.217.248.93

🇬🇧 195.96.139.236

🇲🇽 189.240.44.9

🇨🇳 120.225.242.105

🇺🇬 102.218.89.110

🇺🇸 98.159.37.105

🇺🇸 68.235.57.43

🇺🇸 65.49.1.17

🇳🇱 45.148.10.152

🇮🇩 110.136.123.78

🇲🇬 102.16.125.52

🇺🇸 100.29.192.66

🇺🇸 74.82.47.17

🇺🇸 66.132.172.16

🇺🇸 64.62.197.45

🇺🇸 64.62.156.80

🇩🇪 62.54.176.203

🇺🇸 59.152.127.167

🇳🇱 52.232.19.79