JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.68.244.203

Neutral Activity Whitelisted Subnet

Abuse Confidence Score

0% Low Risk

81 reports

19 reporters · latest 5 days ago

172.68.244.203 is on our whitelist as Cloudflare Reverse Proxy via the subnet 172.64.0.0/13.

ISP: Cloudflare, Inc.
Usage Type: Data Center/Web Hosting/Transit
ASN: AS13335
Domain Name: cloudflare.com
Country: 🇺🇸 United States of America
City: Ashburn, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

81 from 19 distinct reporters

First reported

December 6th 2022

Most recent report

5 days ago

Last 60 days

Top reporter locations 🇧🇪 Belgium 1 🇨🇿 Czechia 1 🇩🇪 Germany 1

Most common categories Web App Attack 3 Brute-Force 3 Port Scan 1

Recent reports We have received reports of abusive activity from this IP address within the last week. This IP is on our whitelist as Cloudflare Reverse Proxy. Shared services like this are often reported for traffic that is not abuse, so review the reports before blocking.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 wiredalter	2026-11-10 13:55:32 UTC · (5 days ago)	Blocked by UFW on dVPS [8443/tcp] Source Port: 10573 TTL: 53 Packet Length: 60 TOS: 0x00 Analyzed by https://ip.wiredalter.com	Port Scan Brute-Force
🇫🇷 dynamix	2026-11-05 23:36:50 UTC · (1 week ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-10-08 01:17:20 UTC · (1 month ago)	IP matched detection query bad paths many.	Brute-Force Web App Attack
🇵🇰 sbk97 (https://sayor.net)	2026-10-04 07:42:20 UTC · (1 month ago)	SAYOR honeypot: observed attack /[DOMAIN]/.env	Brute-Force
🇧🇪 madeit	2026-09-26 07:46:16 UTC · (1 month ago)		Web App Attack
🇺🇸 robotstxt	2026-09-09 09:36:24 UTC · (2 months ago)	172.68.244.203 - - [09/Sep/2026:09:35:04 +0000] "GET /.zsh_history HTTP/2.0" 403 2 "https://www.blimburnseeds.com/.zsh_history" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bytespider; +https://z ... show more 172.68.244.203 - - [09/Sep/2026:09:35:04 +0000] "GET /.zsh_history HTTP/2.0" 403 2 "https://www.blimburnseeds.com/.zsh_history" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bytespider; +https://zhanzhang.toutiao.com/) Chrome/91.0.5571.126 Safari/537.36" "34.145.186.131" edge="172.68.244.203" 172.68.244.203 - - [09/Sep/2026:09:35:07 +0000] "GET /.env.vault HTTP/2.0" 403 2 "https://www.blimburnseeds.com/.env.vault" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; facebookexternalhit/1.1; +http://www.facebook.com/externalhit_uatext.php)" "34.145.186.131" edge="172.68.244.203" 172.68.244.203 - - [09/Sep/2026:09:35:32 +0000] "GET /config/aws.yml HTTP/2.0" 403 36156 "https://www.blimburnseeds.com/config/aws.yml" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.1 Mobile/15E148 Safari/604.1; compatible; Slackbot-LinkExpanding/1.0; +https://api.slack.com/robots" "34.1 ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-29 22:10:45 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 18:10:40.630583 2026] [security2:error] [pid 5375:tid 5375] [client 172.68.244.203:13426] M ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 18:10:40.630583 2026] [security2:error] [pid 5375:tid 5375] [client 172.68.244.203:13426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.dreamscometruefilms.com"] [uri "/.git/config"] [unique_id "apNY4DfSsOjy56qRo7ztsQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 23:26:18 UTC · (2 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 19:26:14.054093 2026] [security2:error] [pid 25406:tid 25406] [client 172.68.244.203:10928] ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 19:26:14.054093 2026] [security2:error] [pid 25406:tid 25406] [client 172.68.244.203:10928] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.agrizel.com"] [uri "/.git/config"] [unique_id "aoTqFgdRioFvBaEWFblMUwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 pinguin	2026-05-01 10:10:11 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: / UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-ac ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: / UA: Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇧 pinguin	2026-04-24 22:27:17 UTC · (6 months ago)	Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/ ... show more Triggered Cloudflare WAF (firewallManaged) from US. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇧🇾 lns.bz	2026-04-07 01:02:02 UTC · (7 months ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 19:44:24 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 15:44:19.001817 2026] [security2:error] [pid 11639:tid 11639] [client 172.68.244.203:14121] ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 15:44:19.001817 2026] [security2:error] [pid 11639:tid 11639] [client 172.68.244.203:14121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.criticalmassofficial.com"] [uri "/.env.test"] [unique_id "adK7k5sHrTNHKd4OMVcAkAAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 08:17:43 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 04:17:37.446311 2026] [security2:error] [pid 1987:tid 1987] [client 172.68.244.203:11961] M ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 04:17:37.446311 2026] [security2:error] [pid 1987:tid 1987] [client 172.68.244.203:11961] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.baker15.com"] [uri "/.env.backup"] [unique_id "adIaobatv8mpDMCzxtAoiwAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-05 00:52:52 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 20:52:44.592680 2026] [security2:error] [pid 21686:tid 21686] [client 172.68.244.203:12084] ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 20:52:44.592680 2026] [security2:error] [pid 21686:tid 21686] [client 172.68.244.203:12084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.meta24.vip"] [uri "/config/.env"] [unique_id "adGyXMBlw7YK3zH-sg4RFwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 19:43:02 UTC · (7 months ago)	(mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 15:42:56.966665 2026] [security2:error] [pid 7387:tid 7387] [client 172.68.244.203:13708] M ... show more (mod_security) mod_security (id:210492) triggered by 172.68.244.203 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 15:42:56.966665 2026] [security2:error] [pid 7387:tid 7387] [client 172.68.244.203:13708] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.tersch.com"] [uri "/.env.production"] [unique_id "adFpwFnZi9wr-D65E-bX2QAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 81 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 204.76.203.212

🇫🇷 185.194.178.34

🇺🇸 172.236.228.39

🇺🇸 162.216.149.211

🇺🇸 104.154.157.71

🇮🇳 103.211.21.213

🇷🇴 80.94.92.179

🇺🇸 57.151.107.218

🇸🇬 47.84.143.141

🇬🇧 35.203.210.216

🇨🇳 218.4.214.115

🇷🇴 193.46.255.86

🇺🇸 185.102.112.73

🇺🇸 165.22.165.207

🇧🇪 158.173.67.23

🇫🇮 130.49.114.12

🇺🇸 91.230.168.210

🇳🇱 35.214.239.121

🇸🇪 13.60.225.189

🇺🇸 216.25.90.11