Neutral Activity
There is no recent abuse activity, or the IP address is whitelisted.
Whitelisted Subnet
Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who
may use them for search engine spiders. However, these same entities sometimes also provide cloud
servers and mail services which are easily abused. Pay special attention when trusting or
distrusting these IPs.
This IP address has been reported a total of
162
times from
47 distinct
sources.
172.70.248.53 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Bulgaria
with 2
reports;
United States of America
with 2
reports;
Belgium
with 1
report.
The most common categories in these recent reports were:
Web App Attack
7
times;
Bad Web Bot
3
times;
Hacking
2
times;
Exploited Host
1
time;
Brute-Force
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show moreAutomated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
{"level":"info","ts":1786330587.9416482,"logger":"http.log.access.log1","msg":"handled request","req ...
show more{"level":"info","ts":1786330587.9416482,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.53","remote_port":"10461","client_ip":"172.70.248.53","proto":"HTTP/1.1","method":"GET","host":"status.antclub.org","uri":"/dex.php","headers":{"X-Forwarded-Proto":["https"],"Cf-Ipcountry":["DE"],"Cf-Ray":["a28bba3e9be314f9-FRA"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"X-Forwarded-For":["4.184.238.149"],"Cdn-Loop":["cloudflare; loops=1"],"Cf-Connecting-Ip":["4.184.238.149"],"Connection":["Keep-Alive"],"Accept-Encoding":["gzip, br"]}},"bytes_read":0,"user_id":"","duration":0.000051828,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.antclub.org/dex.php"],"Content-Type":[]}}
{"level":"info","ts":1786330587.9618537,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.53","remote_port":"10468","client_ip":"172.70.248.53","proto":"HTTP/1.1","method":"GET","host":"st
...
show less
Suspected of having performed illicit activity on LAX server.
Web App Attack
Anonymous
2026-08-06T05:07:39.602743+02:00 nimbus sshd[289654]: pam_unix(sshd:auth): authentication failure; l ...
show more2026-08-06T05:07:39.602743+02:00 nimbus sshd[289654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.70.248.53 user=root
2026-08-06T05:07:41.656156+02:00 nimbus sshd[289654]: Failed password for root from 172.70.248.53 port 63107 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-08-06T04:28:55.112574+02:00 nimbus sshd[287556]: Invalid user admin from 172.70.248.53 port 610 ...
show more2026-08-06T04:28:55.112574+02:00 nimbus sshd[287556]: Invalid user admin from 172.70.248.53 port 61097
...
show less
Brute-Force
SSH
Anonymous
2026-08-06T03:44:02.430219+02:00 nimbus sshd[284764]: pam_unix(sshd:auth): authentication failure; l ...
show more2026-08-06T03:44:02.430219+02:00 nimbus sshd[284764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.70.248.53 user=root
2026-08-06T03:44:03.737783+02:00 nimbus sshd[284764]: Failed password for root from 172.70.248.53 port 50456 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-08-06T02:27:01.359545+02:00 nimbus sshd[279697]: Invalid user postgres from 172.70.248.53 port ...
show more2026-08-06T02:27:01.359545+02:00 nimbus sshd[279697]: Invalid user postgres from 172.70.248.53 port 50999
...
show less
