JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.8.96.108

204.8.96.108 was found in our database!

This IP was reported 217 times. Confidence of Abuse is 55%: ?

55%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Quintex Alliance Consulting
Usage Type	Data Center/Web Hosting/Transit
ASN	AS62744
Hostname(s)	tor18.quintex.com
Domain Name	quintex.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.8.96.108

Whois 204.8.96.108

IP Abuse Reports for 204.8.96.108:

This IP address has been reported a total of 217 times from 71 distinct sources. 204.8.96.108 was first reported on April 15th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 abdubhai	2026-07-30 02:08:39 (1 day ago)	204.8.96.108 - - [30/Jul/2026:07 ...	Brute-Force
🇮🇩 securejdprop	2026-07-26 03:27:45 (5 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 72). show less	Hacking Web App Attack
🇮🇩 securejdprop	2026-07-25 02:17:17 (6 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 72). show less	Hacking Web App Attack
🇵🇹 Subnet Shadow Specter	2026-07-24 07:51:37 (1 week ago)	[CRITICAL][Security Alert] Honeypot decoy endpoint triggered; malicious intent signature detected (T ... show more [CRITICAL][Security Alert] Honeypot decoy endpoint triggered; malicious intent signature detected (Tor Exit Node). [Method]: => GET. [Request]: / [User-Agent]: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36. [OS]: Apple. [IP Address]: 204.8.96.108. [IoA Datetime]: 2026-07-24 04:24:56 UTC +1. show less	Bad Web Bot Hacking Open Proxy Spoofing Web App Attack
🇵🇹 Subnet Shadow Specter	2026-07-24 03:24:51 (1 week ago)	[CRITICAL][Security Alert] Honeypot decoy endpoint triggered; malicious intent signature detected (T ... show more [CRITICAL][Security Alert] Honeypot decoy endpoint triggered; malicious intent signature detected (Tor Exit Node). [Method]: => GET. [Request]: / [User-Agent]: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 [OS]: Unknown. [IP Address]: 204.8.96.108. [IoA Datetime]: 2026-07-24 04:24:51 UTC +1. show less	Open Proxy Port Scan Hacking Spoofing Bad Web Bot Exploited Host Web App Attack
Anonymous	2026-07-23 23:16:04 (1 week ago)	Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1, GET /wp-login.php HTTP/1.1	Hacking Web App Attack
Anonymous	2026-07-23 06:08:24 (1 week ago)		Web Spam Bad Web Bot
🇺🇸 xmission.com	2026-07-22 10:53:22 (1 week ago)	Blocked by UFW (TCP on 9001) Source port: 49264 TTL: 54 Packet length: 52 TOS: 0x08 This report (fo ... show more Blocked by UFW (TCP on 9001) Source port: 49264 TTL: 54 Packet length: 52 TOS: 0x08 This report (for 204.8.96.108) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇩🇪 iGroupware	2026-07-21 18:49:35 (1 week ago)	{"req/ip"=>{:discriminator=>"204.8.96.108", :count=>1, :period=>180, :limit=>500, :epoch_time=>17846 ... show more {"req/ip"=>{:discriminator=>"204.8.96.108", :count=>1, :period=>180, :limit=>500, :epoch_time=>1784659775}, "signups/ip"=>{:discriminator=>"204.8.96.108", :count=>1, :period=>3600, :limit=>5, :epoch_time=>1784659775}, "signups/email"=>{:discriminator=>"[email protected]", :count=>3, :period=>86400, :limit=>2, :epoch_time=>1784659775}} show less	Web App Attack
🇮🇩 securejdprop	2026-07-20 22:48:40 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 72). show less	Hacking Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-07-14 07:51:37 (2 weeks ago)	HTTP flood against /retreat-corp on Apache webserver	Brute-Force
🇺🇸 TPI-Abuse	2026-07-11 14:14:15 (2 weeks ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.108 (tor18.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.108 (tor18.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 10:14:11.922132 2026] [security2:error] [pid 16886:tid 16886] [client 204.8.96.108:46186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|doctorbalog.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "doctorbalog.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alJPs8_1PdFuqT_Tct3JxwAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-09 21:36:08 (3 weeks ago)	[redacted] 204.8.96.108 - - [09/Jul/2026:23:35:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mo ... show more [redacted] 204.8.96.108 - - [09/Jul/2026:23:35:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36" [redacted] 204.8.96.108 - - [09/Jul/2026:23:35:39 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36" [redacted] 204.8.96.108 - - [09/Jul/2026:23:35:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36" [redacted] 204.8.96.108 - - [09/Jul/2026:23:35:46 +0200] "POST /xmlrpc.php HTTP/1.1" 200 206 "-" "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36" [redacted] 204.8.96.108 - - [09/Jul/2026:23:35:49 +0200] "POST /xmlrpc.ph ... show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 19:10:34 (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.108 (tor18.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.108 (tor18.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 15:10:28.688786 2026] [security2:error] [pid 4599:tid 4599] [client 204.8.96.108:39136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|christaylorjazzpianist.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "christaylorjazzpianist.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ak_yJHi_biSTiDgEAU5QpgAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 LRob	2026-07-08 09:28:41 (3 weeks ago)	CrowdSec: crowdsecurity/http-wordpress_user-enum \| req: ["/?author=1","/?author=2","/?author=3","/?a ... show more CrowdSec: crowdsecurity/http-wordpress_user-enum \| req: ["/?author=1","/?author=2","/?author=3","/?author=4","/?author=5","/?author=6"] \| UA: ["Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"] show less	Web App Attack

Showing 1 to 15 of 217 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇷 213.176.26.182

🇮🇷 194.5.176.86

🇺🇸 147.185.132.177

🇸🇬 136.85.75.94

🇷🇴 193.32.162.42

🇩🇪 167.94.146.44

🇱🇾 102.211.7.162

🇺🇸 40.76.116.105

🇭🇰 31.77.203.33

🇺🇸 2607:f8b0:4001:c11::123

🇵🇰 223.123.71.253

🇺🇸 172.253.223.219

🇹🇭 147.50.227.79

🇻🇳 123.25.115.189

🇰🇷 118.37.214.187

🇿🇦 102.249.12.24

🇷🇴 80.94.92.234

🇫🇷 51.68.111.204

🇳🇱 46.151.31.71

🇨🇦 204.62.246.88