JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.64.200.208

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

77 reports

32 reporters · latest 3 hours ago

172.64.200.208 is on our whitelist as Cloudflare Reverse Proxy via the subnet 172.64.0.0/13.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇵🇱 Poland
City: Warsaw, Mazovia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

77 from 32 distinct reporters

First reported

March 20th 2026

Most recent report

3 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 41 🇩🇪 Germany 10 🇧🇪 Belgium 6

Most common categories Web App Attack 66 Bad Web Bot 41 Brute-Force 39 Hacking 4 Exploited Host 3

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Cloudflare Reverse Proxy. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 f2_IT	2026-11-13 14:25:41 UTC · (3 hours ago)	Blocked web application exploit attempt (WAF rule %!s(*string=0x1bac1d8fdc60))	Web App Attack
Anonymous	2026-11-13 04:07:34 UTC · (14 hours ago)	Trying to access config files	Web App Attack
🇧🇪 boxed-it	2026-11-13 00:30:07 UTC · (17 hours ago)	GET /.git/config (Tarpitted for 17s, wasted 1.05kB)	Web App Attack
🇩🇪 tsZero	2026-11-12 21:45:25 UTC · (20 hours ago)	Scan example: path=/.git/HEAD status=404	Hacking
🇧🇪 boxed-it	2026-11-12 21:07:18 UTC · (21 hours ago)	GET /.git/HEAD (Tarpitted for 19s, wasted 1.17kB)	Web App Attack
🇩🇪 FeG Deutschland	2026-11-12 20:39:47 UTC · (21 hours ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14	Exploited Host Web App Attack
🇧🇪 boxed-it	2026-11-12 18:05:29 UTC · (1 day ago)	GET /.git/config (Tarpitted for 18s, wasted 1.17kB)	Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 15:30:20 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:30:12.369609 2026] [security2:error] [pid 13268:tid 13268] [client 172.64.200.208:14073] ... show more (mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 10:30:12.369609 2026] [security2:error] [pid 13268:tid 13268] [client 172.64.200.208:14073] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.investorsfundingusa.com"] [uri "/.git/HEAD"] [unique_id "avXbhPSAeXZK9k8_Y6xdgAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 Rocky Mountain Bioengineering Symposium	2026-11-12 13:29:58 UTC · (1 day ago)	172.64.200.208 - - [12/Nov/2026:06:29:58 -0700] "GET /.git/config HTTP/2.0" 300 4342 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:126.0) Gecko/20100101 Firefox/126.0" ...	Web App Attack
🇧🇪 voormedia	2026-11-12 11:24:48 UTC · (1 day ago)	Accessed trap at '/.git/HEAD'	Web App Attack
🇺🇸 TPI-Abuse	2026-11-12 06:13:16 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:13:11.301750 2026] [security2:error] [pid 2205:tid 2205] [client 172.64.200.208:9762] Mo ... show more (mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:13:11.301750 2026] [security2:error] [pid 2205:tid 2205] [client 172.64.200.208:9762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "handyrehab.zunosaki.com"] [uri "/.git/config"] [unique_id "avVY92gypP4-v61n7yONcwAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-11-12 03:07:08 UTC · (1 day ago)	Trying to access config files	Web App Attack
🇺🇸 xmission.com	2026-11-12 01:45:11 UTC · (1 day ago)	Blocked by UFW (TCP on 443) Source port: 14119 TTL: 46 Packet length: 60 TOS: 0x08 This report (for 172.64.200.208) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 21:48:41 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:48:34.268204 2026] [security2:error] [pid 25119:tid 25119] [client 172.64.200.208:9674] ... show more (mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:48:34.268204 2026] [security2:error] [pid 25119:tid 25119] [client 172.64.200.208:9674] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.rutledgestaircase.com"] [uri "/.git/HEAD"] [unique_id "avTisni9gEg1EoWbEEf4sgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-11-11 21:23:26 UTC · (1 day ago)	(mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:23:23.203752 2026] [security2:error] [pid 20607:tid 20607] [client 172.64.200.208:10491] ... show more (mod_security) mod_security (id:210492) triggered by 172.64.200.208 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:23:23.203752 2026] [security2:error] [pid 20607:tid 20607] [client 172.64.200.208:10491] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.northfultonneurology.com"] [uri "/.git/config"] [unique_id "avTcy-Yg3_bqkpx0DuDhzwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 77 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 206.189.19.232

🇮🇳 122.102.126.74

🇺🇸 104.28.228.77

🇺🇸 104.28.196.77

🇺🇸 205.210.31.105

🇬🇪 194.31.8.12

🇨🇭 179.43.153.18

🇸🇮 102.220.161.170

🇦🇱 79.106.215.164

🇧🇾 37.212.89.53

🇮🇹 34.17.171.130

🇺🇸 20.106.75.210

🇩🇪 194.88.98.126

🇳🇱 193.47.62.69

🇧🇷 201.37.95.66

🇹🇳 196.176.183.227

🇷🇺 188.242.28.1

🇺🇸 147.185.132.59

🇨🇳 117.81.212.152

🇰🇪 105.165.142.169