JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.8.96.143

204.8.96.143 was found in our database!

This IP was reported 210 times. Confidence of Abuse is 33%: ?

33%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Quintex Alliance Consulting
Usage Type	Commercial
ASN	AS62744
Hostname(s)	tor54.quintex.com
Domain Name	quintex.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.8.96.143

Whois 204.8.96.143

IP Abuse Reports for 204.8.96.143:

This IP address has been reported a total of 210 times from 65 distinct sources. 204.8.96.143 was first reported on April 16th 2024, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 homeshowdomain.nl	2026-07-13 21:59:30 (1 day ago)	Auto-ban: >3000 req/min op 2026-07-13	Web App Attack SSH Hacking
🇺🇸 TPI-Abuse	2026-07-13 15:54:15 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 11:54:11.437991 2026] [security2:error] [pid 32190:tid 32190] [client 204.8.96.143:40808] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.automationmp.com"] [uri "/.git/config"] [unique_id "alUKI-MpuW1ZoJLWGA6OfgAAACA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 15:28:57 (1 day ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 11:28:52.452144 2026] [security2:error] [pid 4173:tid 4187] [client 204.8.96.143:34078] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|datuinc.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "datuinc.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alUENJ3hdqIYKYY15fhG2wAAAQc"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-11 02:28:49 (4 days ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇮🇩 securejdprop	2026-07-06 13:53:51 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 70). Ip 204.8.96.143 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-07-06 13:53:50.762445552 +0000 UTC show less	Hacking Web App Attack
Anonymous	2026-07-02 12:00:58 (1 week ago)	2026-07-02 04:01:01,709 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 2026-07-02 ... show more 2026-07-02 04:01:01,709 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 2026-07-02 07:00:28,973 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 2026-07-02 10:00:22,022 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 2026-07-02 13:00:14,940 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 2026-07-02 15:00:51,937 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.143 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-02-08 21:39:45 (5 months ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 08 16:39:41.118883 2026] [security2:error] [pid 6753:tid 6753] [client 204.8.96.143:36324] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|geckoturner.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "geckoturner.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aYkCnbdlmwkPV6Bkfma_7QAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-05 13:50:59 (5 months ago)	(mod_security) mod_security (id:210492) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210492) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 08:50:52.555045 2026] [security2:error] [pid 13980:tid 13980] [client 204.8.96.143:40558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jennlaurenphotography.com"] [uri "/.git/config"] [unique_id "aYSgPFJgkCsi6GWSaG3GLAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-03 08:32:02 (5 months ago)	(mod_security) mod_security (id:210730) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 204.8.96.143 (tor54.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 03 03:31:54.909365 2026] [security2:error] [pid 29328:tid 29328] [client 204.8.96.143:50308] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|\|F\|2"] [data ".mdb"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "web179.dnchosting.com"] [uri "/cgi-bin/news.mdb"] [unique_id "aYGyeiWspj93ZNG1s6Qe_wAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 gu-alvareza	2026-02-02 07:05:09 (5 months ago)	Generic.Path.Traversal.Detection	Port Scan
🇺🇸 gu-alvareza	2026-02-01 07:05:09 (5 months ago)	Cross.Site.Scripting	Hacking Web App Attack
🇺🇸 gu-alvareza	2026-01-31 07:05:15 (5 months ago)	Nessus.Scanner	Port Scan
🇺🇸 gu-alvareza	2026-01-30 07:05:18 (5 months ago)	Generic.Path.Traversal.Detection	Port Scan
🇺🇸 gu-alvareza	2026-01-29 07:05:08 (5 months ago)	Cross.Site.Scripting	Hacking Web App Attack
🇫🇷 bigorre.org	2026-01-24 02:33:26 (5 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot

Showing 1 to 15 of 210 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 222.175.181.178

🇰🇷 220.80.248.211

🇹🇼 198.235.24.123

🇮🇳 183.82.1.38

🇩🇪 95.90.13.168

🇺🇸 45.33.46.249

🇺🇸 2600:3c01::2000:dff:fe9d:98a0

🇷🇺 185.204.2.68

🇧🇷 181.191.194.175

🇺🇸 172.174.5.146

🇮🇩 110.35.80.116

🇨🇳 106.228.42.156

🇺🇸 81.30.98.92

🇺🇸 66.132.172.199

🇳🇱 45.148.10.120

🇺🇸 44.194.88.211

🇺🇸 44.20.96.234

🇲🇦 41.143.189.237

🇺🇸 2600:3c00::2000:1aff:fe5f:cc8b

🇬🇧 172.237.120.124