JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 178.20.30.155

178.20.30.155 was found in our database!

This IP was reported 18 times. Confidence of Abuse is 15%: ?

15%

ISP	FINE GROUP SERVERS SOLUTIONS LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS46475
Domain Name	finegroupservers.com
Country	🇸🇪 Sweden
City	Marsta, Stockholm

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 178.20.30.155

Whois 178.20.30.155

IP Abuse Reports for 178.20.30.155:

This IP address has been reported a total of 18 times from 10 distinct sources. 178.20.30.155 was first reported on August 14th 2023, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇭 4server	2026-07-22 01:48:05 (18 hours ago)	[WedJul2203:48:02.6857802026][security2:error][pid308000:tid308393][client178.20.30.155:0]ModSecurit ... show more [WedJul2203:48:02.6857802026][security2:error][pid308000:tid308393][client178.20.30.155:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"368\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"marcionetti.es\"][uri\"/xmlrpc.php\"][unique_id\"amAhUsmUBQaJ9WgeOCrMmgAAAEg\"] show less	Hacking Web App Attack
🇨🇭 Origon	2026-07-21 21:10:52 (22 hours ago)	http-wordpress-scan - IP: 178.20.30.155 - time="2026-07-21T23:10:52+02:00" level=info msg="(555f66b ... show more http-wordpress-scan - IP: 178.20.30.155 - time="2026-07-21T23:10:52+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-wordpress-scan by ip 178.20.30.155 (US/59651) : 4h ban on Ip 178.20.30.155" module=db show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-06 11:07:17 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 07:07:11.898280 2026] [security2:error] [pid 5662:tid 5662] [client 178.20.30.155:51385] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|cypro.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cypro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afsg31OBU2Yls-qLUdPgbAAAAA4"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-30 19:06:35 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 15:06:29.956538 2026] [security2:error] [pid 26132:tid 26132] [client 178.20.30.155:51315] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|siczewicz.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "siczewicz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afOoNXeuqN1HULPehYvHkgAAAA0"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-04-29 03:45:07 (2 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇨🇿 ptlab	2026-04-20 22:49:37 (3 months ago)	Detected wp_login attack from WP-host.	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-13 14:13:17 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 10:13:11.064708 2026] [security2:error] [pid 376327:tid 376327] [client 178.20.30.155:59007] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|scotts.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "scotts.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adz59wCsjMT5T0BU6-pMYgAAAAg"], referer: https://www.google.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 island-freaks.com	2026-04-10 08:45:30 (3 months ago)	Attack Type: WordPress Exploit Bot attempt on /photo/113997/ \| DNS 178.20.30.155 \| Agent: Mozilla/5. ... show more Attack Type: WordPress Exploit Bot attempt on /photo/113997/ \| DNS 178.20.30.155 \| Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 show less	Port Scan Hacking Bad Web Bot Exploited Host Web App Attack
🇨🇿 lp	2026-03-10 07:40:43 (4 months ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2026-03-10T07:04:45+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2026-03-10T07:04:45+01:00 vpn Access-Reject 'todd69' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2026-03-04 13:27:08 (4 months ago)	Unauthorized VPN login attempts: 2 attempts were recorded from 178.20.30.155 2026-03-04T14:20:07+01: ... show more Unauthorized VPN login attempts: 2 attempts were recorded from 178.20.30.155 2026-03-04T14:20:07+01:00 vpn Access-Reject 'kidder' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-03-04T14:20:13+01:00 vpn Access-Reject 'darthvader' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇩🇪 C C	2026-02-25 14:31:50 (4 months ago)	Distributed proxy crawl wave (184 requests, 184 unique IPs, 68 ASNs in 760 sec); unauth. bot traffic ... show more Distributed proxy crawl wave (184 requests, 184 unique IPs, 68 ASNs in 760 sec); unauth. bot traffic w/o verification; first observed at 2026-02-25T00:03:58+01:00 show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-22 14:28:53 (6 months ago)	(mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:225170) triggered by 178.20.30.155 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 09:28:47.800456 2026] [security2:error] [pid 7186:tid 7186] [client 178.20.30.155:56903] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|nekstlevel.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "nekstlevel.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXI0H4Ja2ZR0MKDeTSbG3AAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇿 lp	2025-08-12 21:22:14 (11 months ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-08-12T22:02:53+02: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-08-12T22:02:53+02:00 vpn Access-Reject 'llee' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-08-11 10:51:10 (11 months ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-08-11T11:37:45+02: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-08-11T11:37:45+02:00 vpn Access-Reject 'banca' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack
🇨🇿 lp	2025-03-16 01:21:41 (1 year ago)	Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-03-16T01:05:40+01: ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.30.155 2025-03-16T01:05:40+01:00 vpn Access-Reject 'loy223' station: 178.20.30.155 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less	Brute-Force Web App Attack

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 111.225.148.140

🇺🇸 2607:f8b0:4001:c17::125

🇺🇸 209.85.128.197

🇨🇷 200.5.55.55

🇺🇸 198.12.254.228

🇺🇸 173.239.254.145

🇩🇪 159.65.126.60

🇧🇩 103.78.226.87

🇳🇱 91.92.40.43

🇰🇿 31.132.90.3

🇺🇸 20.10.203.190

🇬🇧 5.226.140.40

🇺🇸 3.90.162.221

🇺🇸 205.210.31.97

🇧🇬 193.24.211.76

🇧🇷 179.185.227.77

🇺🇸 162.241.50.50

🇷🇴 92.118.39.78

🇺🇸 91.230.168.11

🇩🇪 87.153.248.232