JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.15.52.209

204.15.52.209

Recent Activity

18 reports found in our database

53% ▲ ▲ ▲ Elevated

Abuse confidence score ?

ISP

INTERSTATE TELECOMMUNICATIONS COOPERATIVE, INC.

Usage Type

Fixed Line ISP

ASN

AS15204

Hostname(s)

204-15-52-209.d2.itctel.com

Domain Name

itc-web.com

Country

🇺🇸 United States of America

City

Chester, South Dakota

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 204.15.52.209:

This IP address has been reported a total of 18 times from 13 distinct sources. 204.15.52.209 was first reported on August 13th 2025, and the most recent report was 20 hours ago. In the last 60 days, the top reporter locations were: Germany with 3 reports; Italy with 2 reports; Finland with 1 report. The most common categories in these recent reports were: Brute-Force 9 times; Bad Web Bot 2 times; Email Spam 2 times; Web App Attack 2 times; DDoS Attack 1 time; Other 2 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 ELYAZ	2026-09-03 06:46:10 (20 hours ago)	(wordpress) Failed wordpress login from 204.15.52.209 (US/United States/204-15-52-209.d2.itctel.com) ... show more (wordpress) Failed wordpress login from 204.15.52.209 (US/United States/204-15-52-209.d2.itctel.com): (CF_ENABLE) show less	Brute-Force
🇩🇪 neckaralb-admin.de	2026-09-02 20:55:58 (1 day ago)	(wordpress) Failed login wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-09-02 17:18:45 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 204.15.52.209 (204-15-52-209.d2.itctel.com): 1 ... show more (mod_security) mod_security (id:225170) triggered by 204.15.52.209 (204-15-52-209.d2.itctel.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 02 13:18:38.646119 2026] [security2:error] [pid 29761:tid 29761] [client 204.15.52.209:40521] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|tcit.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "tcit.org"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aphabpjnMJffdy4Cp7WafQAAADM"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 Voluna	2026-09-02 04:27:30 (1 day ago)	2026-09-02T04:27:28.306233+00:00 MailServer-Slave sshd[1148160]: pam_unix(sshd:auth): authentication ... show more 2026-09-02T04:27:28.306233+00:00 MailServer-Slave sshd[1148160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=204.15.52.209 2026-09-02T04:27:30.286717+00:00 MailServer-Slave sshd[1148160]: Failed password for invalid user admin from 204.15.52.209 port 50903 ssh2 ... show less	Brute-Force SSH
🇮🇹 VHosting	2026-08-29 15:10:03 (5 days ago)	Detected mail brute force attack from different servers	Brute-Force
🇷🇺 DZBOT	2026-08-25 02:02:29 (1 week ago)	DZBOT: [MTA] NO LOGIN / auth failed	Port Scan Brute-Force
🇬🇧 Apache	2026-08-20 07:22:59 (2 weeks ago)	(wplogin) WordPress login brute-force 204.15.52.209 (US/United States/204-15-52-209.d2.itctel.com): ... show more (wplogin) WordPress login brute-force 204.15.52.209 (US/United States/204-15-52-209.d2.itctel.com): 5 in the last 300 secs show less	Brute-Force
🇭🇺 kranem	2026-08-11 09:00:03 (3 weeks ago)	Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 15204 (INTERSTATE TELECOMMUNICATIONS COOP ... show more Triggered Cloudflare WAF from US. Action taken: BLOCK ASN: 15204 (INTERSTATE TELECOMMUNICATIONS COOPERATIVE, INC.) Protocol: HTTP/1.1 (GET method) Endpoint: /admin Timestamp: 2026-08-11T08:55:14Z User-Agent: Mozilla/5.0 (Linux; Android 14; V2144 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/132.0.6834.122 Mobile Safari/537.36 Line/15.1.0/IAB show less	Bad Web Bot
🇮🇹 abuseiphack	2026-08-01 20:12:23 (1 month ago)	Automatic report for brute force attack	Brute-Force
🇩🇪 phil2k	2026-07-27 00:22:25 (1 month ago)	Fail2ban: Within 2026-07-25 15:16:26 - 2026-07-25 15:16:26 CEST(+0200) banned: 6 times by fail2ban[< ... show more Fail2ban: Within 2026-07-25 15:16:26 - 2026-07-25 15:16:26 CEST(+0200) banned: 6 times by fail2ban[<MTA>-extra]; 6 times by fail2ban[<MTA>]; 6 times by fail2ban[<MTA>-ddos]; 6 times by fail2ban[recidive] show less	Brute-Force Email Spam DDoS Attack
🇩🇪 phil2k	2026-07-25 13:16:28 (1 month ago)	fail2ban:<MTA>:2026-07-25T15:16:26.356673+02:00 <SRV> <MTA>/smtpd[4166733]: NOQUEUE: reject: RCPT fr ... show more fail2ban:<MTA>:2026-07-25T15:16:26.356673+02:00 <SRV> <MTA>/smtpd[4166733]: NOQUEUE: reject: RCPT from unknown[204.15.52.209]: 450 4.7.25 Client host rejected: cannot find your hostname, [204.15.52.209]; from=<[email protected]> to=<catalin@<ANONYMIZED_DOMAIN>> proto=ESMTP helo=<204-15-52-209.d2.itctel.com> 2026-07-25T15:16:26.686601+02:00 <SRV> <MTA>/smtpd[4166733]: lost connection after RCPT from unknown[204.15.52.209] show less	Email Spam Brute-Force
🇺🇸 Jason Howell	2026-07-04 19:45:24 (1 month ago)	204.15.52.209 - - [04/Jul/2026:14:44:16 -0500] "GET /wp-login.php HTTP/1.1" 200 5467 "-" "Mozilla/5. ... show more 204.15.52.209 - - [04/Jul/2026:14:44:16 -0500] "GET /wp-login.php HTTP/1.1" 200 5467 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299" 204.15.52.209 - - [04/Jul/2026:14:44:18 -0500] "POST /wp-login.php HTTP/1.1" 200 5867 "https://ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299" 204.15.52.209 - - [04/Jul/2026:14:44:49 -0500] "GET /wp-login.php HTTP/1.1" 200 5468 "https://ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299" 204.15.52.209 - - [04/Jul/2026:14:44:51 -0500] "POST /wp-login.php HTTP/1.1" 200 2256 "https://ponderosamobilehomepark.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKi ... show less	Web App Attack
🇨🇭 backslash	2026-06-26 18:57:00 (2 months ago)	block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8	Bad Web Bot
Anonymous	2025-08-18 07:43:55 (1 year ago)	Attempted brute force login to web vpn 2 time(s); last attempt for 2025.08.18 is noted in report tim ... show more Attempted brute force login to web vpn 2 time(s); last attempt for 2025.08.18 is noted in report timestamp show less	Hacking Brute-Force
Anonymous	2025-08-17 18:46:37 (1 year ago)	Attempted brute force login to web vpn 4 time(s); last attempt for 2025.08.17 is noted in report tim ... show more Attempted brute force login to web vpn 4 time(s); last attempt for 2025.08.17 is noted in report timestamp show less	Hacking Brute-Force

Showing 1 to 15 of 18 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇻🇪 200.82.238.233

🇳🇱 185.242.226.102

🇺🇸 147.185.132.203

🇫🇷 51.75.247.232

🇧🇷 16.5.0.245

🇵🇰 2400:adc1:167:e800:e85a:32ef:9aaa:bd28

🇨🇿 212.102.39.12

🇺🇸 205.210.31.51

🇳🇱 195.178.110.30

🇮🇹 188.152.238.126

🇹🇷 176.53.36.29

🇩🇪 139.59.208.225

🇺🇸 91.230.168.232

🇫🇷 85.217.140.23

🇮🇩 36.64.10.42

🇺🇸 34.132.192.176

🇧🇪 34.62.197.254

🇺🇸 20.84.148.29

🇨🇦 184.71.121.54

🇺🇸 162.241.129.114