JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.70.39.48

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

85 reports

15 reporters · latest 4 months ago

172.70.39.48 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

172.70.39.48 has been reported 85 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 172.70.39.48

This IP address has been reported a total of 85 times from 15 distinct sources. 172.70.39.48 was first reported on May 21st 2023, and the most recent report was 4 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-05-14 22:06:50 (4 months ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-13. show less	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-04-08 17:49:17 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 13:49:10.698860 2026] [security2:error] [pid 4098680:tid 4098680] [client 172.70.39.48:13982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.americaskitchencoach.com"] [uri "/.git/logs/HEAD"] [unique_id "adaVFgfdr-v3PHlf_EqxcQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-06 07:39:57 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 03:39:50.509319 2026] [security2:error] [pid 23405:tid 23405] [client 172.70.39.48:10967] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.edmestonfd.com"] [uri "/.env.staging"] [unique_id "adNjRpJkFc9fVjCRbBjLDgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 20:12:10 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 16:12:03.598249 2026] [security2:error] [pid 11023:tid 11023] [client 172.70.39.48:13834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hvacmechanalysis.com"] [uri "/.env.local"] [unique_id "adLCExU42J_41vP31rp0agAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 14:52:06 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 10:51:52.650879 2026] [security2:error] [pid 7678:tid 7678] [client 172.70.39.48:11804] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.souldata.com"] [uri "/.env.tmp"] [unique_id "adJ3CA1rh4rRuo9ETfVDJwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 14:23:23 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 10:23:16.964259 2026] [security2:error] [pid 28622:tid 28622] [client 172.70.39.48:12818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dhappraisalservices.com"] [uri "/.env.prod"] [unique_id "adEe1K1CWrulqasDFwiOAAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 04:55:09 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 00:55:00.580830 2026] [security2:error] [pid 26423:tid 26423] [client 172.70.39.48:12748] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.medicalexchangeasinc.com.hellomdinc.com"] [uri "/api/.env"] [unique_id "adCZpCgGuHYO3l9EwEYLzAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 02:37:58 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 22:37:53.312948 2026] [security2:error] [pid 1487:tid 1487] [client 172.70.39.48:10295] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.yubagals.com"] [uri "/.env.development"] [unique_id "adB5gdsL92RoIbV1P1J0iAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 20:42:57 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 16:42:54.828340 2026] [security2:error] [pid 30012:tid 30012] [client 172.70.39.48:12530] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.serranoscoffee.com"] [uri "/.env.php"] [unique_id "adAmTjbTG_fqz-ylGEWQAgAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 17:48:49 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 13:48:42.756355 2026] [security2:error] [pid 21192:tid 21192] [client 172.70.39.48:11116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "notimallinckrodt.com.ar"] [uri "/.env.staging"] [unique_id "ac_9erbiA1Y5GWIamBezOAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 14:24:36 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 10:24:32.370494 2026] [security2:error] [pid 13877:tid 13877] [client 172.70.39.48:14175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.jaragoodrich.com"] [uri "/.env.container"] [unique_id "ac_NoKWnmHzuGnEtlDUDDwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 13:46:11 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 09:46:04.363459 2026] [security2:error] [pid 18354:tid 18354] [client 172.70.39.48:11308] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.kulacenterky.com"] [uri "/.env.orig"] [unique_id "ac_EnNRK4wCKrZsb22lZhgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 www.mammazone.it	2026-04-03 11:48:24 (5 months ago)	[Fri Apr 03 13:48:23.925349 2026] [proxy_fcgi:error] [pid 295138] [client 172.70.39.48:10544] AH0107 ... show more [Fri Apr 03 13:48:23.925349 2026] [proxy_fcgi:error] [pid 295138] [client 172.70.39.48:10544] AH01071: Got error 'Primary script unknown' ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 08:50:36 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 04:50:30.416617 2026] [security2:error] [pid 3115:tid 3115] [client 172.70.39.48:11756] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.appsdips.com"] [uri "/.env.local"] [unique_id "ac9_VvDogum2O7D8DkoD2AAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 07:39:38 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.70.39.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 03:39:34.402342 2026] [security2:error] [pid 31313:tid 31313] [client 172.70.39.48:9285] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.menafert.com"] [uri "/.env.development"] [unique_id "ac9utprXbKRyqI4Ma-M7AAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 85 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 209.97.189.32

🇵🇦 172.68.96.148

🇺🇸 161.178.140.14

🇺🇸 143.244.170.216

🇺🇸 143.244.159.70

🇺🇸 109.105.210.64

🇳🇱 45.148.10.157

🇨🇳 14.103.117.81

🇮🇳 14.96.24.251

🇺🇸 4.148.17.157

🇰🇷 211.223.41.90

🇧🇪 198.235.24.171

🇨🇮 172.68.13.130

🇫🇷 141.101.68.35

🇨🇦 140.106.25.230

🇨🇳 125.41.231.75

🇨🇳 112.255.236.70

🇰🇷 112.164.217.142

🇷🇺 91.232.116.131

🇺🇸 65.49.1.60