JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.70.38.33

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

119 reports

12 reporters · latest 3 months ago

172.70.38.33 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

172.70.38.33 has been reported 119 times. The most recent report is from 3 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 172.70.38.33

This IP address has been reported a total of 119 times from 12 distinct sources. 172.70.38.33 was first reported on April 9th 2021, and the most recent report was 3 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 mawan	2026-06-14 22:58:16 (3 months ago)	Suspected of having performed illicit activity on LAX server.	Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 08:24:03 (4 months ago)	(mod_security) mod_security (id:949110) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:949110) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:23:47.659978 2026] [security2:error] [pid 24004:tid 24004] [client 172.70.38.33:11594] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "akistech.com"] [uri "/.env.vercel"] [unique_id "agbYEx2bvQ5ufXao_2O_SgAAAAE"], referer: https://www.google.com/search?q=akistech.com show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 02:38:16 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 22:38:11.213921 2026] [security2:error] [pid 25597:tid 25597] [client 172.70.38.33:13878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lambert-heating-and-air.com"] [uri "/.env.bak"] [unique_id "adMck0xPgmvb5ss5cSI13wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 20:59:48 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 16:59:41.648421 2026] [security2:error] [pid 18712:tid 18837] [client 172.70.38.33:9873] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.dcmproductionsgroup.com"] [uri "/.env.example"] [unique_id "adF7vabqqKmINjTtrcgUcgAAAIQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 17:22:06 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 13:21:59.257831 2026] [security2:error] [pid 28344:tid 28344] [client 172.70.38.33:13611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ferienwohnungen-eva.com"] [uri "/config/.env.local"] [unique_id "adFIt96RSJmRoduLQqMXjgAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 14:30:47 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 10:30:38.647338 2026] [security2:error] [pid 32197:tid 32197] [client 172.70.38.33:11477] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.register-yacht-gibraltar.com"] [uri "/.env.docker"] [unique_id "adEgjg1OjCcnWSy2RVnraQAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 09:18:31 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 05:18:28.243269 2026] [security2:error] [pid 5332:tid 5332] [client 172.70.38.33:10773] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.drgracetomastolentino.com"] [uri "/public/.env"] [unique_id "adDXZKaMgoatinm6I8ovbgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 04:52:29 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 00:52:24.074885 2026] [security2:error] [pid 17574:tid 17574] [client 172.70.38.33:12570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xmas.martinka.org"] [uri "/app/.env"] [unique_id "adCZCPcDMGYxjL4Why1sbQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 03:46:36 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:46:27.460024 2026] [security2:error] [pid 23487:tid 23487] [client 172.70.38.33:9699] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dubb.productions"] [uri "/docker/.env"] [unique_id "adCJk06Mc2ExS7c2ZUlD9gAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 16:32:00 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 12:31:55.093578 2026] [security2:error] [pid 3754:tid 3754] [client 172.70.38.33:12309] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.el-pen.com"] [uri "/.env.dev"] [unique_id "ac_rezMI753XVKFI8ubzXQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 15:50:13 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 11:50:06.312079 2026] [security2:error] [pid 10993:tid 10993] [client 172.70.38.33:10398] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.correo.gisur.com"] [uri "/.env.dist"] [unique_id "ac_hrtDe37p8KuXrZg9e7AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 11:45:50 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 07:45:46.381575 2026] [security2:error] [pid 19126:tid 19126] [client 172.70.38.33:12339] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.mukau.com"] [uri "/.env.staging"] [unique_id "ac-oakg3U3eieOCu9CiEIwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 09:15:44 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 05:15:39.969982 2026] [security2:error] [pid 1905:tid 1905] [client 172.70.38.33:14251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arnoldwell.com"] [uri "/.env.staging"] [unique_id "ac-FO5yBemlAk0b12J_5vQAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 07:22:12 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 03:22:04.779937 2026] [security2:error] [pid 20802:tid 20802] [client 172.70.38.33:10179] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.the-board-shop.com"] [uri "/config/.env"] [unique_id "ac9qnE4u8kFVRnGCDsi5GwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 02:10:04 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.38.33 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 22:09:58.310516 2026] [security2:error] [pid 2555:tid 2555] [client 172.70.38.33:9446] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.gardenstateakitaclub.org"] [uri "/.env"] [unique_id "ac8hdhDJeGH7RoGNSrs5mQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 119 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 91.92.42.111

🇺🇸 172.56.32.59

🇸🇬 158.140.149.158

🇵🇰 151.123.145.38

🇺🇦 134.249.36.98

🇹🇼 125.229.145.119

🇮🇩 125.163.213.50

🇹🇭 125.25.17.237

🇵🇰 119.154.121.192

🇵🇭 112.203.81.252

🇺🇸 97.95.174.208

🇺🇸 91.230.168.147

🇺🇦 91.225.162.137

🇳🇱 91.92.42.152

🇺🇸 64.62.156.131

🇺🇸 43.153.77.90

🇬🇧 35.203.211.119

🇺🇸 24.162.4.131

🇺🇸 13.52.252.0

🇪🇬 196.139.233.156