JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.68.193.164

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

113 reports

35 reporters · latest 22 hours ago

172.68.193.164 is on our whitelist as Cloudflare Reverse Proxy via the subnet 172.64.0.0/13.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇩🇪 Germany
City: Frankfurt am Main, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

113 from 35 distinct reporters

First reported

April 9th 2024

Most recent report

22 hours ago

Last 60 days

Top reporter locations 🇧🇪 Belgium 1

Most common categories Web App Attack 1

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Cloudflare Reverse Proxy. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 madeit	2026-11-06 13:03:10 UTC · (22 hours ago)		Web App Attack
🇦🇱 router.al	2026-07-31 20:58:35 UTC · (3 months ago)	07/31/2026-20:58:35.210544 172.68.193.164 Protocol: 6 ET SCAN LeakIX Inbound User-Agent	Hacking
🇫🇷 vtchost.com	2026-07-25 14:44:47 UTC · (3 months ago)	minux.cc:80 172.68.193.164 - - [25/Jul/2026:16:44:47 +0200] "GET /wp-admin/install.php?step=1 HTTP/1.1" 418 215 "-" "http://minux.cc/wp-admin/install.php?step=1" ...	Web App Attack
🇩🇪 abdubhai	2026-06-24 06:44:12 UTC · (4 months ago)	172.68.193.164 - - [24/Jun/2026: ...	Brute-Force
🇩🇪 4server	2026-06-14 14:11:33 UTC · (4 months ago)	[SunJun1416:11:27.7892652026][security2:error][pid2397636:tid2397667][client172.68.193.164:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap\)\"atREQUEST_HEADE ... show more [SunJun1416:11:27.7892652026][security2:error][pid2397636:tid2397667][client172.68.193.164:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\\|wget\\|python\\|nikto\\|sqlmap\\|acunetix\\|fimap\\|dirbuster\\|cmsmap\)\"atREQUEST_HEADERS:user-agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"specialfood.ch.136-243-54-122.cpanel.site\"][uri\"/.git/config\"][unique_id\"ai62j1JCBUvnhLQgbZXBSQAAABQ\"] show less	Port Scan Brute-Force Web App Attack
🇨🇭 ALPHANET	2026-06-10 06:13:03 UTC · (4 months ago)	web exploits	Hacking Exploited Host Web App Attack
🇩🇪 abdubhai	2026-06-09 08:08:51 UTC · (4 months ago)	172.68.193.164 - - [09/Jun/2026: ...	Brute-Force
🇺🇸 TPI-Abuse	2026-06-04 20:11:54 UTC · (5 months ago)	(mod_security) mod_security (id:949110) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 16:11:46.976658 2026] [security2:error] [pid 26926:tid 26926] [client 172.68.193.164:13707] ... show more (mod_security) mod_security (id:949110) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 04 16:11:46.976658 2026] [security2:error] [pid 26926:tid 26926] [client 172.68.193.164:13707] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "freedrm.org"] [uri "/.git/config"] [unique_id "aiHcArZF_hc7ighEHdr2qwAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-04 03:31:39 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 23:31:32.761420 2026] [security2:error] [pid 32314:tid 32314] [client 172.68.193.164:13166] ... show more (mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 23:31:32.761420 2026] [security2:error] [pid 32314:tid 32314] [client 172.68.193.164:13166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "koorsen.net"] [uri "/.git/config"] [unique_id "aiDxlFTKNySRSHIGEJWztAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 14:00:12 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 10:00:05.194206 2026] [security2:error] [pid 24974:tid 24983] [client 172.68.193.164:14333] ... show more (mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 10:00:05.194206 2026] [security2:error] [pid 24974:tid 24983] [client 172.68.193.164:14333] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "luckystarscattery.com"] [uri "/.git/config"] [unique_id "ah7h5TAaO8ySZrHtHlQ7hAAAAUY"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 updown.io	2026-05-29 14:01:43 UTC · (5 months ago)	{"level":"info","ts":1780059940.5029397,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.68.193.164","remote_port":"14770","client_ip":"172.68.193.164","proto":"HTTP/2.0","method":"GET","host":"status.householdcapit ... show more {"level":"info","ts":1780059940.5029397,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.68.193.164","remote_port":"14770","client_ip":"172.68.193.164","proto":"HTTP/2.0","method":"GET","host":"status.householdcapital.com.au","uri":"/loggly/%2eenv","headers":{"True-Client-Ip":["127.0.0.1"],"X-Client-Ip":["127.0.0.1"],"X-Azure-Clientip":["127.0.0.1"],"X-Forwarded-For":["127.0.0.1,185.177.72.13"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"X-Host":["127.0.0.1"],"X-Azure-Socketip":["127.0.0.1"],"Cf-Ipcountry":["FR"],"Cf-Connecting-Ip":["185.177.72.13"],"Cf-Ray":["a035b64409ae2143-FRA"],"X-Originating-Ip":["127.0.0.1"],"X-Forwarded-Proto":["https"],"Accept":["/"],"User-Agent":["curl/8.7.1"],"Cdn-Loop":["cloudflare; loops=1"],"X-Forwared":["127.0.0.1"],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip, br"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.householdcapital.com.au"}},"bytes_read":0,"user ... show less	DDoS Attack Web App Attack
🇷🇺 DZBOT	2026-05-20 10:56:23 UTC · (5 months ago)	DZBOT: Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-05-08 23:23:06 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 19:23:02.657636 2026] [security2:error] [pid 7513:tid 7513] [client 172.68.193.164:12005] M ... show more (mod_security) mod_security (id:210492) triggered by 172.68.193.164 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 19:23:02.657636 2026] [security2:error] [pid 7513:tid 7513] [client 172.68.193.164:12005] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlecreekrvranch.com"] [uri "/.git/config"] [unique_id "af5wVvSdCSNmhZIj7j0ZmAAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 abdubhai	2026-05-07 08:55:18 UTC · (6 months ago)	172.68.193.164 - - [07/May/2026: ...	Brute-Force
🇩🇪 abdubhai	2026-05-04 08:46:10 UTC · (6 months ago)	172.68.193.164 - - [04/May/2026: ...	Brute-Force

Showing 1 to 15 of 113 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇩🇪 2a02:c202:2360:1707::1

🇳🇱 212.30.37.102

🇺🇬 196.0.3.188

🇺🇸 66.94.120.32

🇩🇪 45.92.11.233

🇩🇪 2a02:c202:2359:8387::1

🇩🇪 2a02:c202:2359:6769::1

🇳🇱 212.30.37.90

🇧🇷 201.17.157.128

🇳🇱 195.178.110.151

🇫🇷 185.177.72.66

🇵🇦 181.178.203.164

🇧🇾 178.122.163.32

🇺🇦 176.103.4.117

🇦🇿 158.181.44.80

🇧🇩 103.58.73.154

🇩🇪 89.58.26.216

🇺🇸 71.14.88.89

🇧🇷 20.206.241.122

🇨🇴 206.84.81.16