JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.70.251.48

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

149 reports

42 reporters · latest 5 months ago

172.70.251.48 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

172.70.251.48 has been reported 149 times. The most recent report is from 5 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 172.70.251.48

Export CSV

This IP address has been reported a total of 149 times from 42 distinct sources. 172.70.251.48 was first reported on March 22nd 2022, and the most recent report was 5 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-05-06 23:06:54 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 19:06:44.799890 2026] [security2:error] [pid 25975:tid 25975] [client 172.70.251.48:9780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.larsholm.com"] [uri "/.git/config"] [unique_id "afvJhCSJX9bjGPsm71jf0AAAABQ"], referer: https://www.google.com/search?q=autodiscover.larsholm.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-30 20:03:09 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 16:03:02.777989 2026] [security2:error] [pid 24404:tid 24404] [client 172.70.251.48:13990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.notepromd.com"] [uri "/.git/config"] [unique_id "afO1dnS4xF3o_7Ad5Ch5_AAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-30 08:59:21 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 04:59:18.951728 2026] [security2:error] [pid 31003:tid 31003] [client 172.70.251.48:14262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.lloydprins.com"] [uri "/.git/config"] [unique_id "afMZ5rKaIMgLLFk2-Etf5AAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-30 08:23:06 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 30 04:23:01.002966 2026] [security2:error] [pid 25360:tid 25360] [client 172.70.251.48:11028] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.garrygwilt.com"] [uri "/.git/config"] [unique_id "afMRZePlCGJ3SgdSSOFGxwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-25 00:26:53 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 20:26:46.444969 2026] [security2:error] [pid 1638546:tid 1638546] [client 172.70.251.48:9238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jazzclubla.com"] [uri "/.git/config"] [unique_id "aewKRsYMdPJHdInLNnfmtQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 21:04:55 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 17:04:51.673730 2026] [security2:error] [pid 9482:tid 9482] [client 172.70.251.48:10316] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.sponsorzilla.com"] [uri "/.git/logs/HEAD"] [unique_id "adLOc2VoZdGB-tVoYakoEwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 21:15:41 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 17:15:36.800111 2026] [security2:error] [pid 21423:tid 21423] [client 172.70.251.48:10404] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.jrpiano.com"] [uri "/app/.env"] [unique_id "adF_eHEDgvKrqCKfJfQlIwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 OptimusGO	2026-04-04 16:43:26 (6 months ago)	Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Time ... show more Malicious activity detected: web_attack Server: commstackbc (185.127.18.66) Attack: web_attack Timestamp: 2026-04-04 17:43:25 UTC Log evidence: Binary file /var/log/suricata/fast.log matches show less	Port Scan Brute-Force
🇳🇱 Site.eu	2026-04-04 07:57:11 (6 months ago)	Excessive 404/403 errors	Brute-Force
🇳🇱 e.fierstra	2026-04-04 03:58:57 (6 months ago)	ModSecurity hits exceeded	Bad Web Bot Web App Attack
🇩🇪 tentwentyfour	2026-04-03 10:14:23 (6 months ago)	Blocked for probing for sensitive web application components	Brute-Force Web App Attack
🇫🇷 masterguru	2026-04-02 00:11:03 (6 months ago)	Blocked Cloudflare Worker request. Pattern match "." at REQUEST_HEADERS:cf-worker. (5025-193)	Hacking
🇺🇸 TPI-Abuse	2026-04-01 12:22:54 (6 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 172.70.251.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 08:22:49.414228 2026] [security2:error] [pid 2726:tid 2726] [client 172.70.251.48:9602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.accomplishedmagazine.com"] [uri "/.git/HEAD"] [unique_id "ac0OGVcaKoibkCg-25PvpAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 mnsf	2026-04-01 03:06:51 (6 months ago)	Scanning/Probing (17)	Brute-Force Web App Attack
🇺🇸 mnsf	2026-03-31 02:06:58 (6 months ago)	Scanning/Probing (15)	Brute-Force Web App Attack

Showing 1 to 15 of 149 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇺 168.144.175.105

🇷🇺 213.33.182.183

🇧🇷 205.210.31.177

🇮🇩 202.145.0.61

🇺🇸 147.185.132.212

🇺🇸 135.233.115.110

🇺🇸 129.121.78.234

🇮🇳 121.242.232.216

🇿🇦 102.33.32.31

🇸🇬 35.197.152.134

🇨🇭 34.65.29.111

🇩🇪 2.28.60.103

🇰🇷 222.116.49.135

🇺🇸 216.25.89.89

🇮🇹 212.66.100.243

🇺🇸 199.165.159.57

🇸🇬 43.134.85.158

🇨🇱 34.176.233.225

🇺🇸 34.122.173.216

🇺🇸 20.65.202.209