This IP address has been reported a total of
10
times from
8 distinct
sources.
172.70.243.246 was first reported on
September 29th 2026 , and the most recent report was
1 day ago .
In the last 60 days, the top reporter locations were:
United States of America
with 4
reports;
Australia
with 1
report;
Belgium
with 1
report.
The most common categories in these recent reports were:
Web App Attack
7
times;
Bad Web Bot
4
times;
Brute-Force
4
times;
Port Scan
1
time;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
2026-10-14 12:34:59
(1 day ago)
(caddyscan) Scanner path probe from 172.70.243.246 (DE/Germany/-): 5 in the last 3600 secs; Ports: * ...
show more
(caddyscan) Scanner path probe from 172.70.243.246 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 172.70.243.246 - - [14/Oct/2026:12:34:57 +0000] "GET /azure/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.243.246 - - [14/Oct/2026:12:34:57 +0000] "GET /gcp/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.243.246 - - [14/Oct/2026:12:34:58 +0000] "GET /cloud/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.243.246 - - [14/Oct/2026:12:34:58 +0000] "GET /infrastructure/.env HTTP/1.1"
[REDACTED] 200 2627 172.70.243.246 - - [14/Oct/2026:12:34:58 +0000] "GET /docker/.env HTTP/1.1"
show less
Port Scan
๐บ๐ธ
TPI-Abuse
2026-10-14 03:00:47
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:00:40.037118 2026] [security2:error] [pid 8480:tid 8480] [client 172.70.243.246:12731] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||sundancepei.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sundancepei.com"] [uri "/db.sql"] [unique_id "as7wWCUMe5GzR6G2YgMjPwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฌ๐ง
CrystalMaker
2026-10-14 01:24:02
(1 day ago)
Vulnerability scan - GET /database.sql
Hacking
๐ณ๐ด
jad-abuse
2026-10-13 22:10:38
(2 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: config_ba ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: config_backup, source_backup. Observed by 1 sensor(s); 1 hits.
show less
Web App Attack
๐ซ๐ท
dynamix
2026-10-13 16:43:47
(2 days ago)
Multiple WAF Violations
Web App Attack
๐บ๐ฆ
URAN Publishing Service
2026-10-13 11:19:49
(2 days ago)
[13/Oct/2026:14:19:48 +0300] -- 172.70.243.246 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp- ...
show more
[13/Oct/2026:14:19:48 +0300] -- 172.70.243.246 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/plugins/woocommerce/readme.txt HTTP/1.1
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-10 14:02:39
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 10:02:34.578046 2026] [security2:error] [pid 16307:tid 16307] [client 172.70.243.246:9425] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jamroomrecording.com"] [uri "/.git/config"] [unique_id "aspFemOmiyoR4bFri4ib5wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฆ๐บ
dyln
2026-10-09 22:12:25
(6 days ago)
Dyls honeypot brute-force: proto8 (1 total hits)
Brute-Force
๐บ๐ธ
TPI-Abuse
2026-10-07 12:41:15
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 08:41:11.989505 2026] [security2:error] [pid 29294:tid 29294] [client 172.70.243.246:12634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uheep2.spaceritual.net"] [uri "/.git/config"] [unique_id "asY95x7i_onst8MbbSuHOQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ง๐ช
madeit
2026-09-29 19:21:09
(2 weeks ago)
Web App Attack
Showing 1 to
10
of 10 reports