JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

172.71.6.225

Neutral Activity Whitelisted Subnet

Abuse confidence score ?

0% Low Risk

26 reports

10 reporters · latest 7 months ago

172.71.6.225 is an IP address from within our whitelist belonging to the subnet 172.64.0.0/13, which we identify as "Cloudflare Reverse Proxy".

ISP	Cloudflare, Inc.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS13335
Domain Name	cloudflare.com
Country	🇧🇷 Brazil
City	Sao Paulo, Sao Paulo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

172.71.6.225 has been reported 26 times. The most recent report is from 7 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 172.71.6.225

Export CSV

This IP address has been reported a total of 26 times from 10 distinct sources. 172.71.6.225 was first reported on April 12th 2022, and the most recent report was 7 months ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-02-18 12:09:40 (7 months ago)	[Wed Feb 18 13:09:27.860791 2026] [authz_core:error] [pid 31258] [client 172.71.6.225:10331] AH01630 ... show more [Wed Feb 18 13:09:27.860791 2026] [authz_core:error] [pid 31258] [client 172.71.6.225:10331] AH01630: client denied by server configuration: /etc/httpd/htdocs [Wed Feb 18 13:09:30.520731 2026] [authz_core:error] [pid 31258] [client 172.71.6.225:10331] AH01630: client denied by server configuration: /etc/httpd/htdocs [Wed Feb 18 13:09:39.700241 2026] [authz_core:error] [pid 30814] [client 172.71.6.225:12200] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
🇯🇵 S.O.B.A. Dev.	2025-10-10 12:47:03 (11 months ago)	Persistent port scanning or vulnerability scanning	Port Scan
🇬🇧 pinguin	2025-07-20 04:52:38 (1 year ago)	Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/1.1 (GET method ... show more Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇧 pinguin	2025-06-23 18:05:44 (1 year ago)	Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/1.1 (GET method ... show more Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇧 pinguin	2025-06-17 03:57:46 (1 year ago)	Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallManaged) from BR. Action taken: LOG Protocol: HTTP/2 (GET method) Endpoint: / UA: Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers' presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: [email protected] This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
Anonymous	2025-06-10 05:46:36 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 drewf.ink	2025-05-30 05:44:29 (1 year ago)	[05:44] Port scanning. Port(s) scanned: TCP/8443	Port Scan
Anonymous	2025-04-06 03:28:00 (1 year ago)	[Sun Apr 06 05:27:42.353611 2025] [authz_core:error] [pid 30348] [client 172.71.6.225:38240] AH01630 ... show more [Sun Apr 06 05:27:42.353611 2025] [authz_core:error] [pid 30348] [client 172.71.6.225:38240] AH01630: client denied by server configuration: /etc/httpd/htdocs [Sun Apr 06 05:27:58.153908 2025] [authz_core:error] [pid 30037] [client 172.71.6.225:61762] AH01630: client denied by server configuration: /etc/httpd/htdocs [Sun Apr 06 05:27:59.924044 2025] [authz_core:error] [pid 30037] [client 172.71.6.225:61762] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
Anonymous	2025-04-04 03:50:06 (1 year ago)	Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER	Brute-Force SSH
🇺🇸 TPI-Abuse	2025-03-19 10:12:15 (1 year ago)	(mod_security) mod_security (id:210492) triggered by 172.71.6.225 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 172.71.6.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 19 06:12:09.948103 2025] [security2:error] [pid 26644:tid 26644] [client 172.71.6.225:19562] [client 172.71.6.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kryptonome.com"] [uri "/.env"] [unique_id "Z9qYeYOQ125Ngih2h3_u_wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Study Bitcoin 🤗	2025-01-04 12:06:43 (1 year ago)	2 port probes: 2x tcp/80 (http) [srv125]	Port Scan Bad Web Bot Web App Attack
🇳🇱 Study Bitcoin 🤗	2025-01-04 11:54:39 (1 year ago)	4 port probes: 4x tcp/80 (http) [srv125]	Port Scan Bad Web Bot Web App Attack
🇳🇱 Study Bitcoin 🤗	2024-12-23 15:36:37 (1 year ago)	2 port probes: 2x tcp/80 (http) [srv125]	Port Scan Bad Web Bot Web App Attack
🇳🇱 Study Bitcoin 🤗	2024-12-23 15:34:37 (1 year ago)	Port probe to tcp/80 (http) [srv125]	Port Scan Bad Web Bot Web App Attack
🇧🇷 Sargon Bercot	2024-12-16 16:51:07 (1 year ago)	172.71.6.225 - - [16/Dec/2024:13:51:06 -0300] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT ... show more 172.71.6.225 - - [16/Dec/2024:13:51:06 -0300] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.71.6.225 - - [16/Dec/2024:13:51:06 -0300] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 172.71.6.225 - - [16/Dec/2024:13:51:06 -0300] "GET / HTTP/1.1" 301 178 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Brute-Force SSH

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 217.113.196.22

🇦🇺 207.211.156.160

🇪🇬 197.53.126.84

🇰🇼 188.236.124.42

🇺🇸 172.86.72.242

🇨🇳 120.48.176.104

🇫🇷 91.196.152.105

🇫🇷 91.196.152.101

🇨🇦 45.198.224.235

🇷🇺 5.165.19.3

🇷🇴 2.57.121.25

🇨🇱 216.155.93.75

🇳🇱 165.232.87.235

🇮🇶 150.228.105.130

🇿🇲 102.23.121.113

🇳🇱 94.154.43.69

🇫🇷 91.196.152.1

🇷🇺 89.151.189.122

🇧🇬 79.124.62.126

🇰🇷 14.63.217.28