AbuseIPDB » 172.70.39.143

172.70.39.143 was found in our database!

This IP was reported 53 times. Confidence of Abuse is 0%: ?

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
Domain Name	cloudflare.com
Country	United States of America
City	Ashburn, Virginia

Important Note: 172.70.39.143 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as: "Cloudflare Reverse Proxy".

Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.

Report 172.70.39.143

Whois 172.70.39.143

IP Abuse Reports for 172.70.39.143:

This IP address has been reported a total of 53 times from 17 distinct sources. 172.70.39.143 was first reported on August 4th 2021, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Study Bitcoin 🤗	2024-11-30 21:10:31 (1 week ago)	Port probe to tcp/443 (https) [srv130]	Port Scan Brute-Force Bad Web Bot Web App Attack
Study Bitcoin 🤗	2024-11-08 12:14:35 (1 month ago)	Port probe to tcp/443 (https) [srv130]	Port Scan Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-10-30 14:31:29 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.143 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 172.70.39.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 30 10:31:25.391745 2024] [security2:error] [pid 6774:tid 6774] [client 172.70.39.143:31630] [client 172.70.39.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.easy-byte.net"] [uri "/.git/config"] [unique_id "ZyJDPcReb7n32Ss3y6INmwAAAB4"] show less	Brute-Force Bad Web Bot Web App Attack
sefinek.net	2024-07-22 04:31:53 (4 months ago)	IP: 172.70.39.143 Protocol: TCP Source port: 22032 Destination port: 443 TTL ... show moreIP: 172.70.39.143 Protocol: TCP Source port: 22032 Destination port: 443 TTL: 47 Packet length: 40 TOS: 0x08 Timestamp: Jul 22 01:03:50 (01:03:50, 22.07.2024) The IP address was blocked by the Uncomplicated Firewall (UFW) due to suspicious activity. Packet details indicate a possible unauthorized access attempt or network scan. show less	Port Scan Web App Attack
Anonymous	2024-07-11 13:28:36 (4 months ago)	Web Probe / Attack	Web App Attack
el-brujo	2024-06-15 22:52:35 (5 months ago)	16/Jun/2024:00:52:34.127209 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more16/Jun/2024:00:52:34.127209 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 172.70.39.143] ModSecurity: Access denied with code 406 (phase 2). Pattern match "<[Ss][Cc][Rr][Ii][Pp][Tt]" at ARGS:pass. [file "/etc/httpd/conf.d/mod_security.conf"] [line "80"] [id "500003"] [hostname "warzone.elhacker.net"] [uri "/reg.php"] [unique_id "Zm4bMla0twimT1NkpYDtYQACUDA"] ... show less	Hacking Hacking Web App Attack Web App Attack
el-brujo	2024-06-14 00:54:15 (5 months ago)	14/Jun/2024:02:54:15.421945 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more14/Jun/2024:02:54:15.421945 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 172.70.39.143] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'n)UEv' [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: n)UEv found within ARGS:nick: JIXiziFU) UNION ALL select NULL -- "] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "warzone.elhacker.net"] [uri "/reg.php"] [unique_id "ZmuUt0hKsk5-e3Yo56vgAQAA3SE"] ... show less	Hacking Hacking Web App Attack Web App Attack
Anonymous	2024-04-10 07:40:17 (7 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Yepngo	2024-04-10 02:32:49 (7 months ago)	172.70.39.143 - - [10/Apr/2024:04:32:48 +0200] "POST /wp-login.php HTTP/2.0" 200 9373 "-" "Mozilla/5 ... show more172.70.39.143 - - [10/Apr/2024:04:32:48 +0200] "POST /wp-login.php HTTP/2.0" 200 9373 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
Yepngo	2024-04-09 21:06:38 (7 months ago)	172.70.39.143 - - [09/Apr/2024:23:06:38 +0200] "POST /wp-login.php HTTP/2.0" 200 9366 "-" "Mozilla/5 ... show more172.70.39.143 - - [09/Apr/2024:23:06:38 +0200] "POST /wp-login.php HTTP/2.0" 200 9366 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
Yepngo	2024-04-09 19:58:36 (7 months ago)	172.70.39.143 - - [09/Apr/2024:21:14:12 +0200] "POST /wp-login.php HTTP/2.0" 200 9366 "-" "Mozilla/5 ... show more172.70.39.143 - - [09/Apr/2024:21:14:12 +0200] "POST /wp-login.php HTTP/2.0" 200 9366 "-" "Mozilla/5.0" 172.70.39.143 - - [09/Apr/2024:21:58:35 +0200] "POST /wp-login.php HTTP/2.0" 200 9366 "-" "Mozilla/5.0" ... show less	Brute-Force Web App Attack
Anonymous	2024-03-31 00:28:48 (8 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
Anonymous	2024-03-16 12:32:19 (8 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
sweplox.se	2024-01-31 17:25:21 (10 months ago)	172.70.39.143 - - [31/Jan/2024:17:24:49 +0000] "GET /.well-known/acme-challenge/license.php HTTP/1.1 ... show more172.70.39.143 - - [31/Jan/2024:17:24:49 +0000] "GET /.well-known/acme-challenge/license.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 172.70.39.143 - - [31/Jan/2024:17:24:50 +0000] "GET /.well-known/acme-challenge/iR7SzrsOUEP.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 172.70.39.143 - - [31/Jan/2024:17:25:06 +0000] "GET /.well-known/acme-challenge/atomlib.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36" 172.70.39.143 - - [31/Jan/2024:17:25:17 +0000] "GET /.well-known/acme-challenge/cloud.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" 172.70.39.143 - - [31/Jan/2024:17:25:19 +0000] "GET /.well-known/acme-challenge/wso112233.php HTTP/1.1" 301 162 "-" "Mozilla/5. ... show less	Bad Web Bot SSH
TPI-Abuse	2024-01-20 20:29:44 (10 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.143 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 172.70.39.143 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 20 15:29:37.675923 2024] [security2:error] [pid 7068] [client 172.70.39.143:32020] [client 172.70.39.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.antitribu.com"] [uri "/.svn/wc.db"] [unique_id "ZawtMT6eLzCdx-tL_H-sNQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack