This IP address has been reported a total of
117
times from
103 distinct
sources.
107.170.52.128 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
Reported from Nginx log analysis 16. Log: 107.170.52.128 - - [25/Jun/2026:xx:xx:xx 0200] "GET /.env ...
show moreReported from Nginx log analysis 16. Log: 107.170.52.128 - - [25/Jun/2026:xx:xx:xx 0200] "GET /.env HTTP/2.0" xxx xxx "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "-" "US United States Secaucus" "AS14061" "DigitalOcean, LLC"
show less
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
...
show moreTriggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
Endpoint: /.env
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/144.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
[ThuJun2508:10:38.1332722026][security2:error][pid1542824:tid1542906][client107.170.52.128:0]ModSecu ...
show more[ThuJun2508:10:38.1332722026][security2:error][pid1542824:tid1542906][client107.170.52.128:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"autodiscover.creazione-siti-web-ticino.ch\"][uri\"/.env\"][unique_id\"ajzGXjUIOwXEraiQbgxd7QAAAAc\"]
show less
{"time":"2026-06-25T05:54:27+00:00","ip":"107.170.52.128","method":"GET","uri":"/.env","ua":"Mozilla ...
show more{"time":"2026-06-25T05:54:27+00:00","ip":"107.170.52.128","method":"GET","uri":"/.env","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/144.0","referer":""}
...
show less
Bunkerweb ModSecurity alert: Potential Remote Command Execution (RCE) detected. Unix shell code was ...
show moreBunkerweb ModSecurity alert: Potential Remote Command Execution (RCE) detected. Unix shell code was identified within the request arguments, triggering a security rule designed to prevent application attacks.
show less
Brute-Force
Showing 1 to
15
of 117 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩