JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.217.128.200

204.217.128.200 was found in our database!

This IP was reported 12 times. Confidence of Abuse is 33%: ?

33%

ISP	Aventice LLC
Usage Type	Fixed Line ISP
ASN	AS11572
Domain Name	aventice.com
Country	🇺🇸 United States of America
City	Ashburn, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.217.128.200

Whois 204.217.128.200

IP Abuse Reports for 204.217.128.200:

This IP address has been reported a total of 12 times from 10 distinct sources. 204.217.128.200 was first reported on June 22nd 2022, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 librebit	2026-10-12 22:30:18 (4 days ago)	Brute force	Brute-Force
🇵🇱 Budyn	2026-10-10 03:01:12 (1 week ago)	Budyn SOC Canary Trap: AWS Key Compromised! \| Memo: AWS_Token_7 \| Action: AWS API Call \| Token: 4dv ... show more Budyn SOC Canary Trap: AWS Key Compromised! \| Memo: AWS_Token_7 \| Action: AWS API Call \| Token: 4dvmm7wgh55qaj86jjj1vqe1z \| Client Tool: aws-cli/2.33.12 md/awscrt#0.31.1 ua/2.1 os/linux#5.15.0-191-generic md/arch#x86_64 lang/python#3.13.11 md/pyimpl#CPython m/b,g,Z,E cfg/retry-mode#standard md... show less	Hacking Bad Web Bot Web App Attack
🇩🇪 LRob	2026-09-28 15:01:18 (2 weeks ago)	Not following 301 redirects — wasted requests \| method: GET \| path: /_c \| ua: Mozilla/5.0 (Windows N ... show more Not following 301 redirects — wasted requests \| method: GET \| path: /_c \| ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 \| 2026-09-28 15:01 UTC show less	Bad Web Bot
🇫🇷 digital-plus-experience.com	2026-09-27 07:56:04 (2 weeks ago)	Probe for vulnerabilities. Path attempted: /.well-known/security	Web App Attack
🇩🇪 LRob	2026-09-22 01:03:19 (3 weeks ago)	This address requests our sites over plain http, is answered with a redirect to https, and never fol ... show more This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. \| method: GET \| path: / \| 2026-09-22 01:03 UTC show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-19 16:46:51 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 204.217.128.200 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210492) triggered by 204.217.128.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 12:46:46.087630 2026] [security2:error] [pid 31186:tid 31186] [client 204.217.128.200:62397] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cageliners.net"] [uri "/.git/HEAD"] [unique_id "aq68dt2DXEafAcnu9vajAAAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-13 10:03:09 (1 month ago)	Web App Attack	Brute-Force Exploited Host Web App Attack
Anonymous	2026-08-27 19:30:43 (1 month ago)	\| SQL injection attempt.	Web App Attack Hacking SQL Injection
🇺🇸 TPI-Abuse	2026-08-16 08:51:40 (2 months ago)	(mod_security) mod_security (id:210730) triggered by 204.217.128.200 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 204.217.128.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 16 04:51:07.986510 2026] [security2:error] [pid 4676:tid 4686] [client 204.217.128.200:27311] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|aafm.org\|F\|2"] [data ".gafm.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aafm.org"] [uri "/www.GAFM.com"] [unique_id "aoF5-8x_4gFov4n9sqml8wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-30 13:15:47 (2 months ago)	Malicious activity detected	Hacking Web App Attack
Anonymous	2026-07-22 00:45:25 (2 months ago)	This IP was involved in a brute force and password spray attack.	Brute-Force Web App Attack
🇺🇸 VSM Networks	2022-06-22 15:30:51 (4 years ago)	Credential Stuffing	Brute-Force

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 183.101.53.155

🇵🇰 153.117.32.204

🇺🇸 103.195.146.223

🇺🇸 4.150.187.151

🇧🇷 177.192.15.77

🇮🇹 149.22.91.165

🇺🇸 142.147.201.18

🇭🇰 103.243.27.155

🇬🇧 81.149.107.57

🇮🇳 74.225.146.100

🇸🇬 47.79.205.245

🇺🇸 40.117.97.0

🇺🇸 35.245.62.139

🇳🇱 34.32.216.134

🇦🇷 191.82.255.210

🇧🇷 177.181.5.0

🇲🇾 175.136.34.14

🇧🇪 66.249.93.102

🇱🇹 62.60.134.134

🇰🇷 211.62.96.42