This IP address has been reported a total of
92
times from
19 distinct
sources.
172.70.80.168 was first reported on
May 1st 2024 , and the most recent report was
13 hours ago France
with 5
reports;
Belgium
with 2
reports;
Czechia
with 1
report.
The most common categories in these recent reports were:
Web App Attack
8
times;
Brute-Force
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
dynamix
2026-10-19 00:15:29
(13 hours ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-16 07:55:35
(3 days ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-13 12:41:59
(6 days ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-02 03:01:07
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-09-24 10:21:54
(3 weeks ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-09-22 15:34:39
(3 weeks ago)
Web App Attack
2026-09-17 21:03:47
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇧🇪
madeit
2026-09-08 06:03:18
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-13 14:23:02
(2 months ago)
Web App Attack
2026-07-23 07:01:22
(2 months ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
2026-07-06 19:30:05
(3 months ago)
| Multiple SQL injection attempts from same source ip.(multiple servers)
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-07-02 12:07:53
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 08:07:45.716573 2026] [security2:error] [pid 23168:tid 23168] [client 172.70.80.168:12662] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.podbillspec.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.podbillspec.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "akZUkS6df8LJiNpw-j-9FgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-24 04:27:57
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 00:27:50.082203 2026] [security2:error] [pid 4183:tid 4183] [client 172.70.80.168:13907] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.gabosoftware.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.gabosoftware.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ajtcxr0HlKJcrcvb2MG8pwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 03:01:33
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 09 23:01:29.047175 2026] [security2:error] [pid 23382:tid 23382] [client 172.70.80.168:9813] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.genesis-one.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.genesis-one.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "aijTiVwXohz8F157JuiOuAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 06:51:15
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.168 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 02:51:10.092994 2026] [security2:error] [pid 23247:tid 23247] [client 172.70.80.168:11746] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.cgiaquaticcare.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.cgiaquaticcare.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ag6rXj8HTQJ_lXDS5m6NowAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Showing 1 to
15
of 92 reports
