JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 47.54.59.70

47.54.59.70 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 38%: ?

38%

ISP	Bell Canada
Usage Type	Fixed Line ISP
ASN	AS855
Hostname(s)	drmons0552w-47-54-59-70.dhcp-dynamic.fibreop.ns.bellaliant.net
Domain Name	bell.ca
Country	🇨🇦 Canada
City	Dartmouth, Nova Scotia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 47.54.59.70

Whois 47.54.59.70

IP Abuse Reports for 47.54.59.70:

This IP address has been reported a total of 17 times from 10 distinct sources. 47.54.59.70 was first reported on July 30th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Tilellit.PRO	2026-10-20 02:52:56 (2 days ago)	Fail2Ban banned 47.54.59.70 for security violations in jail wp-armour. Log: 2026/10/20 02:52:55 [err ... show more Fail2Ban banned 47.54.59.70 for security violations in jail wp-armour. Log: 2026/10/20 02:52:55 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 47.54.59.70 \| Type: wplogin \| URI: /wp-login.php" , client: 47.54.59.70, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://caffebook.it/wp-login.php" ... show less	Web Spam
🇫🇷 LRob	2026-10-19 00:36:39 (3 days ago)	Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 ... show more Not following 301 redirects — wasted requests \| method: POST \| path: /wp-login.php \| ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 show less	Bad Web Bot
🇷🇺 AbuseIPDB informer	2026-10-13 10:05:07 (1 week ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 13:05:07.200 \| duration 00:00:00.237 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 13:05:07.200 \| duration 00:00:00.237 \| flows=4 \| packets=101277 \| bytes=72.9 M \| pps=426 \| bps=2.5 M \| bpp=719 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-13 10:05:07 (1 week ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 13:05:07.200 \| duration 00:00:00.241 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 13:05:07.200 \| duration 00:00:00.241 \| flows=10 \| packets=239382 \| bytes=175.2 M \| pps=991 \| bps=5.8 M \| bpp=731 \| proto=udp show less	DDoS Attack Port Scan Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-13 08:15:21 (1 week ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 08:15:21.472 \| duration 00:00:00.190 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-13 08:15:21.472 \| duration 00:00:00.190 \| flows=8 \| packets=307923 \| bytes=224.8 M \| pps=1612 \| bps=9.4 M \| bpp=730 \| proto=any show less	DDoS Attack Port Scan Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-12 09:24:30 (1 week ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-12 12:24:30.848 \| duration 00:00:00.145 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-12 12:24:30.848 \| duration 00:00:00.145 \| flows=3 \| packets=71610 \| bytes=51.3 M \| pps=491 \| bps=2.8 M \| bpp=715 \| proto=udp show less	DDoS Attack Exploited Host
🇷🇺 AbuseIPDB informer	2026-10-11 21:46:58 (1 week ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-11 21:46:58.048 \| duration 00:00:00.170 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-11 21:46:58.048 \| duration 00:00:00.170 \| flows=14 \| packets=271095 \| bytes=198.3 M \| pps=1590 \| bps=9.3 M \| bpp=731 \| proto=any show less	DDoS Attack Exploited Host
🇭🇺 bcsaba	2026-10-11 13:43:20 (1 week ago)	CMS (WordPress or Joomla) login attempt. 47.54.59.70 - - [11/Oct/2026:15:43:19 +0200] "POST /wp-logi ... show more CMS (WordPress or Joomla) login attempt. 47.54.59.70 - - [11/Oct/2026:15:43:19 +0200] "POST /wp-login.php HTTP/2.0" 200 4275 "https://REDACTED/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" show less	Hacking Brute-Force Web App Attack
🇷🇺 AbuseIPDB informer	2026-10-08 10:43:05 (2 weeks ago)	nfdump top talker: 47.54.59.70 \| first seen 2026-10-08 13:43:05.088 \| duration 00:00:00.084 \| flows= ... show more nfdump top talker: 47.54.59.70 \| first seen 2026-10-08 13:43:05.088 \| duration 00:00:00.084 \| flows=13 \| packets=457281 \| bytes=343.6 M \| pps=5396 \| bps=32.4 M \| bpp=751 \| proto=any show less	DDoS Attack Port Scan Exploited Host
🇩🇪 Packets-Decreaser.NET	2026-10-04 05:32:42 (2 weeks ago)	Incoming Layer 7 Flood Detected	DDoS Attack Web Spam
🇺🇸 mnsf	2026-09-29 00:05:33 (3 weeks ago)	Too many Status 40X (11)	Brute-Force Web App Attack
🇩🇪 LRob	2026-09-09 01:21:03 (1 month ago)	Enumerating paths that do not exist (scanning) \| method: GET \| path: /wp-json/wp/v2/users/me \| 2026- ... show more Enumerating paths that do not exist (scanning) \| method: GET \| path: /wp-json/wp/v2/users/me \| 2026-09-09 01:21 UTC show less	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-09-08 13:00:28 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 47.54.59.70 (drmons0552w-47-54-59-70.dhcp-dynam ... show more (mod_security) mod_security (id:225170) triggered by 47.54.59.70 (drmons0552w-47-54-59-70.dhcp-dynamic.fibreop.ns.bellaliant.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 08 09:00:21.552877 2026] [security2:error] [pid 25322:tid 25322] [client 47.54.59.70:46364] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|jerryfeil.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jerryfeil.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aqAG5atUkxM9Zfs7DNiHDwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 HaloAgencySAS	2026-08-19 21:57:55 (2 months ago)	UDP flood (DDoS) vs AS215599: 1008181 pkts / 1441.68 MB to UDP 80/8443 across 512 dst IP(s), 2026-08 ... show more UDP flood (DDoS) vs AS215599: 1008181 pkts / 1441.68 MB to UDP 80/8443 across 512 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host
🇫🇷 Zkillu	2026-08-19 21:57:55 (2 months ago)	UDP flood (DDoS) vs AS215599: 1008181 pkts / 1441.68 MB to UDP 80/8443 across 512 dst IP(s), 2026-08 ... show more UDP flood (DDoS) vs AS215599: 1008181 pkts / 1441.68 MB to UDP 80/8443 across 512 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters. show less	DDoS Attack Exploited Host

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇳 163.61.110.233

🇺🇸 162.216.149.125

🇦🇷 149.78.146.26

🇮🇳 121.242.232.216

🇩🇪 109.160.32.165

🇩🇪 109.160.32.135

🇰🇷 61.73.187.235

🇮🇪 54.170.75.129

🇫🇷 51.159.52.113

🇺🇸 2001:4860:4846:400::

🇦🇺 203.18.243.123

🇩🇪 167.94.146.46

🇮🇳 152.52.15.213

🇻🇳 144.79.12.156

🇷🇺 138.16.179.161

🇷🇺 109.173.38.135

🇨🇳 106.59.139.153

🇨🇿 89.203.185.131

🇺🇸 69.55.54.138

🇸🇬 47.236.109.219