JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 68.221.130.241

68.221.130.241 was found in our database!

This IP was reported 396 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇪🇸 Spain
City	Madrid, Madrid

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 68.221.130.241

Whois 68.221.130.241

IP Abuse Reports for 68.221.130.241:

This IP address has been reported a total of 396 times from 324 distinct sources. 68.221.130.241 was first reported on July 24th 2026, and the most recent report was 7 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 9LEVEL.com.br	2026-07-25 05:43:55 (7 minutes ago)	Blocked by Fail2ban for traefik-404 abuse	Web App Attack
🇩🇪 33three	2026-07-25 05:42:21 (8 minutes ago)	Fail2Ban jail WebAttack triggered	Brute-Force
Anonymous	2026-07-25 05:35:25 (15 minutes ago)	Detected by CrowdSec: crowdsecurity/http-probing	Web App Attack
🇺🇸 deskpass.com	2026-07-25 05:28:20 (22 minutes ago)	GET /public/vx.php	Web App Attack
🇻🇳 trung.fun	2026-07-25 05:27:52 (23 minutes ago)	DDoS, Hack, Brute Force, Web Attack ...	DDoS Attack Web Spam Hacking Brute-Force Web App Attack
🇩🇪 Admins@FBN	2026-07-25 05:24:00 (26 minutes ago)	FW-PortScan: Traffic Blocked srcport=18582 dstport=80	Port Scan
🇩🇪 mravb	2026-07-25 05:21:41 (29 minutes ago)	68.221.130.241 - - [25/Jul/2026:08:21:40 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 68.221.130.241 - - [25/Jul/2026:08:21:40 +0300] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 404 146 "-" "-" ... show less	Web App Attack Hacking
🇬🇧 openstrike.co.uk	2026-07-25 05:14:55 (36 minutes ago)	973 attacks on PHP URLs: GET /c4.php HTTP/1.1	Web App Attack
🇩🇪 sojan	2026-07-25 05:12:17 (38 minutes ago)	68.221.130.241 - - [25/Jul/2026:07:12:16 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.p ... show more 68.221.130.241 - - [25/Jul/2026:07:12:16 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 502 157 "-" "-" 68.221.130.241 - - [25/Jul/2026:07:12:16 +0200] "GET /this_is_a_new_hello_world.php HTTP/1.1" 502 157 "-" "-" 68.221.130.241 - - [25/Jul/2026:07:12:16 +0200] "GET /SS72_kKKjT.php HTTP/1.1" 502 157 "-" "-" ... show less	Web App Attack
🇺🇸 chronos	2026-07-25 05:09:24 (41 minutes ago)	[AUTORAVALT][[25/07/2026 - 02:09:23 -03:00 UTC] Attack from [Microsoft Corporation] [68.221.130.241] ... show more [AUTORAVALT][[25/07/2026 - 02:09:23 -03:00 UTC] Attack from [Microsoft Corporation] [68.221.130.241] Action: BLocKed Hacking... Unauthorized attempts to access the server. Web App Attack -> Attempts to probe for or exploit installed web applications such as a CMS like WordPress/Drupal, e-commerce solutions, forum software, phpMyAdmin and various other software] ... show less	Hacking Web App Attack
🇩🇪 yvoictra	2026-07-25 05:06:45 (44 minutes ago)	Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-probing	Web App Attack
🇮🇩 soc-yk	2026-07-25 05:06:12 (44 minutes ago)	Type: suspicious_network_activity Risk: 100 Events: 549 Evidence: - Persistent suspicious network a ... show more Type: suspicious_network_activity Risk: 100 Events: 549 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
🇫🇷 vtchost.com	2026-07-25 04:58:52 (52 minutes ago)	minux.cc:80 68.221.130.241 - - [25/Jul/2026:06:58:51 +0200] "GET /wp-content/plugins/hellopress/wp_f ... show more minux.cc:80 68.221.130.241 - - [25/Jul/2026:06:58:51 +0200] "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1" 418 215 "-" "-" ... show less	Web App Attack
🇭🇺 DumaNet	2026-07-25 04:56:00 (54 minutes ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 24. 20:18:46 Source IP: 68.221 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Jul 24. 20:18:46 Source IP: 68.221.130.241 Portion of the log(s): 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /hplfuns.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /7logs.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /wxeyc.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /ifrea.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /exhds0ucw0ju9vjgasxqCdefault.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /yj03.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /mI35rZhMg1zJ1vuXdefault.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /ctjpseby.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 +0200] "GET /nc4.php HTTP/1.1" 404 153 "-" "-" 68.221.130.241 - [24/Jul/2026:20:18:46 show less	Web App Attack
🇩🇪 hchristo	2026-07-25 04:55:54 (55 minutes ago)	[Sat Jul 25 06:55:54.061382 2026] [proxy_fcgi:error] [pid 23822:tid 23882] [client 68.221.130.241:64 ... show more [Sat Jul 25 06:55:54.061382 2026] [proxy_fcgi:error] [pid 23822:tid 23882] [client 68.221.130.241:64120] AH01071: Got error 'Primary script unknown' [Sat Jul 25 06:55:54.141135 2026] [proxy_fcgi:error] [pid 23822:tid 23901] [client 68.221.130.241:64120] AH01071: Got error 'Primary script unknown' [Sat Jul 25 06:55:54.202284 2026] [proxy_fcgi:error] [pid 23822:tid 23907] [client 68.221.130.241:64120] AH01071: Got error 'Primary script unknown' [Sat Jul 25 06:55:54.262945 2026] [proxy_fcgi:error] [pid 23822:tid 23874] [client 68.221.130.241:64120] AH01071: Got error 'Primary script unknown' [Sat Jul 25 06:55:54.324566 2026] [proxy_fcgi:error] [pid 23822:tid 23914] [client 68.221.130.241:64120] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force

Showing 1 to 15 of 396 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 203.159.90.218

🇺🇸 165.1.78.209

🇭🇰 223.197.178.95

🇨🇬 197.214.238.143

🇺🇸 185.223.152.136

🇺🇸 185.223.152.131

🇺🇦 176.103.25.204

🇳🇱 176.65.148.84

🇵🇱 176.53.159.197

🇳🇱 141.101.76.150

🇳🇱 141.101.76.46

🇭🇰 101.36.106.134

🇺🇸 66.132.195.68

🇨🇳 36.32.3.239

🇵🇰 182.180.57.72

🇺🇦 176.105.222.77

🇫🇷 169.58.39.189

🇩🇴 45.175.70.81

🇨🇳 42.81.216.149

🇦🇺 202.130.198.104