JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 172.68.211.85

172.68.211.85 was found in our database!

This IP was reported 56 times. Confidence of Abuse is 0%: ?

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Important Note: 172.68.211.85 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as: "Cloudflare Reverse Proxy".

Whitelisted netblocks are typically owned by trusted entities, such as Google or Microsoft who may use them for search engine spiders. However, these same entities sometimes also provide cloud servers and mail services which are easily abused. Pay special attention when trusting or distrusting these IPs.

Report 172.68.211.85

Whois 172.68.211.85

IP Abuse Reports for 172.68.211.85:

This IP address has been reported a total of 56 times from 18 distinct sources. 172.68.211.85 was first reported on December 20th 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 abdubhai	2026-04-28 10:20:40 (1 month ago)	172.68.211.85 - - [28/Apr/2026:1 ...	Brute-Force
🇫🇷 Campus France	2026-03-28 21:47:31 (2 months ago)	[Sat Mar 28 22:47:01.010776 2026] [php:error] [pid 1343011] [client 172.68.211.85:12297] script '/va ... show more [Sat Mar 28 22:47:01.010776 2026] [php:error] [pid 1343011] [client 172.68.211.85:12297] script '/var/www/html/plss3.php' not found or unable to stat [Sat Mar 28 22:47:01.791185 2026] [php:error] [pid 1343011] [client 172.68.211.85:12297] script '/var/www/html/nfile.php' not found or unable to stat [Sat Mar 28 22:47:03.809719 2026] [php:error] [pid 1343011] [client 172.68.211.85:12297] script '/var/www/html/file1.php' not found or unable to stat [Sat Mar 28 22:47:06.196887 2026] [php:error] [pid 1343011] [client 172.68.211.85:12297] script '/var/www/html/bolt.php' not found or unable to stat [Sat Mar 28 22:47:31.180312 2026] [php:error] [pid 1340730] [client 172.68.211.85:13655] script '/var/www/html/ws.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇫🇷 Campus France	2026-03-25 16:20:37 (2 months ago)	[Wed Mar 25 12:12:05.346032 2026] [php:error] [pid 2810165] [client 172.68.211.85:11864] script '/va ... show more [Wed Mar 25 12:12:05.346032 2026] [php:error] [pid 2810165] [client 172.68.211.85:11864] script '/var/www/html/xv.php' not found or unable to stat [Wed Mar 25 12:12:32.298256 2026] [php:error] [pid 2809891] [client 172.68.211.85:9574] script '/var/www/html/inputs.php' not found or unable to stat [Wed Mar 25 12:12:38.163233 2026] [php:error] [pid 2809891] [client 172.68.211.85:9574] script '/var/www/html/mail.php' not found or unable to stat [Wed Mar 25 17:20:27.403610 2026] [php:error] [pid 2962301] [client 172.68.211.85:12768] script '/var/www/html/goods.php' not found or unable to stat [Wed Mar 25 17:20:36.903712 2026] [php:error] [pid 2962342] [client 172.68.211.85:10863] script '/var/www/html/info.php' not found or unable to stat ... show less	Brute-Force Web App Attack
🇬🇧 openstrike.co.uk	2026-03-16 06:13:34 (2 months ago)	8 attacks on site downloads (type 2), PHP URLs, Javascript arg injection: GET /install HTTP/1.1 GET ... show more 8 attacks on site downloads (type 2), PHP URLs, Javascript arg injection: GET /install HTTP/1.1 GET /index.php?option=com_jejob&view=../../../../../../etc/passwd%00 HTTP/1.1 GET /fw/syslogViewer.do?port=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1 show less	Hacking Web App Attack
🇬🇧 no1knows.com	2026-02-11 02:53:52 (3 months ago)	2026/02/11 02:53:40 [error] 2564692#2564692: 46137 FastCGI sent in stderr: "Primary script unknown" ... show more 2026/02/11 02:53:40 [error] 2564692#2564692: 46137 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.85, server: ldn.no1knows.com, request: "GET /index.php/api/index/info HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "sygvzemgtegfd.no1knows.com", referrer: "http://sygvzemgtegfd.no1knows.com/index.php/api/index/info" 2026/02/11 02:53:44 [error] 2564692#2564692: 46137 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.211.85, server: ldn.no1knows.com, request: "GET /admin/webadmin.php?mod=do&act=login HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host: "sygvzemgtegfd.no1knows.com", referrer: "http://sygvzemgtegfd.no1knows.com/admin/webadmin.php%3Fmod%3Ddo%26act%3Dlogin" 2026/02/11 02:53:50 [error] 2564692#2564692: 46137 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: 172.68.2 ... show less	Brute-Force Bad Web Bot
🇬🇧 openstrike.co.uk	2026-02-07 06:14:37 (3 months ago)	3 attacks on PHP URLs, TP-Link CVE-2023-1389 URLs: POST /wbm/plugins/wbm-legal-information/platform/ ... show more 3 attacks on PHP URLs, TP-Link CVE-2023-1389 URLs: POST /wbm/plugins/wbm-legal-information/platform/pfcXXX/licenses.php HTTP/1.1 POST /cgi-bin/luci/;stok=/locale?form=country HTTP/1.1 show less	Web App Attack IoT Targeted
🇬🇧 openstrike.co.uk	2026-02-02 06:13:23 (4 months ago)	8 attacks on PHP URLs, password grabbing URLs: POST /TransferredOutModal.php?modfunc=detail HTTP/1.1 ... show more 8 attacks on PHP URLs, password grabbing URLs: POST /TransferredOutModal.php?modfunc=detail HTTP/1.1 GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 thefoofighter	2025-11-29 17:55:44 (6 months ago)	[Sat Nov 29 17:55:43.275689 2025] [:error] [pid 3997197] [client 172.68.211.85:13406] [client 172.68 ... show more [Sat Nov 29 17:55:43.275689 2025] [:error] [pid 3997197] [client 172.68.211.85:13406] [client 172.68.211.85] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 7)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.sarahmcnally.com"] [uri "/api/.env"] [unique_id "aSszn7ESpditWEbNqGSi8QAAAAs"] [Sat Nov 29 17:55:44.291856 2025] [:error] [pid 3997199] [client 172.68.211.85:13409] [client 172.68.211.85] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 7)"] [severity "CRITICAL"] [ver "OWASP_C ... show less	Bad Web Bot Web App Attack
🇺🇸 mawan	2025-11-07 19:16:15 (6 months ago)	Suspected of having performed illicit activity on LAX server.	Web App Attack
🇺🇸 Paschen J Ki	2025-10-08 06:10:40 (7 months ago)	Blocked by UFW [8008/tcp] Source port: 30864 TTL: 50 Packet length: 60 TOS: 0x00 This report was ge ... show more Blocked by UFW [8008/tcp] Source port: 30864 TTL: 50 Packet length: 60 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 mawan	2025-09-04 01:41:47 (9 months ago)	Suspected of having performed illicit activity on LAX server.	Web App Attack
🇳🇱 antikirra	2025-08-31 20:12:03 (9 months ago)	Proxy Port Scanning	Port Scan
🇨🇳 ThreatBook.io	2025-06-29 23:49:02 (11 months ago)	ThreatBook Intelligence: Scanner more details on http://threatbook.io/ip/172.68.211.85 2025-06-29 01 ... show more ThreatBook Intelligence: Scanner more details on http://threatbook.io/ip/172.68.211.85 2025-06-29 01:44:38 /myConfig.js show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-28 23:47:35 (11 months ago)	ThreatBook Intelligence: Scanner more details on http://threatbook.io/ip/172.68.211.85 2025-06-28 13 ... show more ThreatBook Intelligence: Scanner more details on http://threatbook.io/ip/172.68.211.85 2025-06-28 13:54:17 /common/member/js/user.util.js show less	Web App Attack
Anonymous	2025-06-28 02:28:42 (11 months ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH

Showing 1 to 15 of 56 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 123.207.72.201

🇩🇪 172.71.144.138

🇺🇸 160.211.70.254

🇨🇳 124.228.34.69

🇺🇸 108.181.2.243

🇩🇪 95.85.238.22

🇷🇴 92.118.39.209

🇨🇦 85.217.149.74

🇺🇸 71.6.134.237

🇺🇸 206.221.176.152

🇧🇷 205.210.31.243

🇹🇼 198.235.24.85

🇺🇸 162.142.125.227

🇮🇳 103.248.120.6

🇺🇸 98.84.184.80

🇩🇪 95.90.13.168

🇪🇸 85.61.90.129

🇪🇸 84.246.215.129

🇲🇽 84.20.24.215

🇷🇴 80.94.92.165