JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.8.96.161

204.8.96.161 was found in our database!

This IP was reported 235 times. Confidence of Abuse is 36%: ?

36%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Quintex Alliance Consulting
Usage Type	Data Center/Web Hosting/Transit
ASN	AS62744
Hostname(s)	tor72.quintex.com
Domain Name	quintex.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.8.96.161

Whois 204.8.96.161

IP Abuse Reports for 204.8.96.161:

This IP address has been reported a total of 235 times from 72 distinct sources. 204.8.96.161 was first reported on April 15th 2024, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 securejdprop	2026-07-22 08:27:45 (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor R ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 383). show less	Hacking Web App Attack
🇧🇪 taivas.nl	2026-07-20 18:32:11 (5 days ago)	Bad_requests	Bad Web Bot
Anonymous	2026-07-20 14:10:57 (5 days ago)	Detected by CrowdSec: crowdsecurity/http-bad-user-agent	Web App Attack
🇳🇱 WeCloudit-Anti-Abuse	2026-07-18 07:52:44 (1 week ago)	HTTP flood against /retreat-corp on Apache webserver	Brute-Force
🇺🇸 TPI-Abuse	2026-07-18 03:30:34 (1 week ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.161 (tor72.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.161 (tor72.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 23:30:28.775737 2026] [security2:error] [pid 17705:tid 17705] [client 204.8.96.161:59474] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|3pl.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "3pl.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alrzVLMewXjh6evqzeZ3QwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-02 12:01:05 (3 weeks ago)	2026-07-02 04:01:02,467 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 2026-07-02 ... show more 2026-07-02 04:01:02,467 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 2026-07-02 07:00:29,704 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 2026-07-02 10:00:22,828 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 2026-07-02 13:00:15,733 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 2026-07-02 15:00:55,708 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.161 show less	Brute-Force
🇺🇸 gu-alvareza	2026-02-13 07:05:04 (5 months ago)	Generic.Path.Traversal.Detection	Port Scan
Anonymous	2026-02-08 00:37:19 (5 months ago)		Web Spam Bad Web Bot
🇦🇺 oncord	2026-02-07 13:15:49 (5 months ago)	Form spam	Web Spam
🇺🇸 TPI-Abuse	2026-02-04 16:19:53 (5 months ago)	(mod_security) mod_security (id:210350) triggered by 204.8.96.161 (tor72.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210350) triggered by 204.8.96.161 (tor72.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 11:19:47.801254 2026] [security2:error] [pid 1245:tid 1390] [client 204.8.96.161:42846] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.rockabyecotons.com\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rockabyecotons.com"] [uri "/"] [unique_id "aYNxo7yz_CHwqdUMvvixpAAAANQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 gu-alvareza	2026-02-03 07:05:15 (5 months ago)	Web.Server.Password.File.Access	Brute-Force
🇺🇸 gu-alvareza	2026-02-02 07:05:09 (5 months ago)	Cross.Site.Scripting	Hacking Web App Attack
🇺🇸 gu-alvareza	2026-02-01 07:05:09 (5 months ago)	PHP.URI.Code.Injection	SQL Injection Web App Attack
🇫🇷 bigorre.org	2026-01-31 10:42:44 (5 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
🇺🇸 gu-alvareza	2026-01-31 07:05:15 (5 months ago)	Cross.Site.Scripting	Hacking Web App Attack

Showing 1 to 15 of 235 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.154.189

🇳🇱 195.178.110.211

🇦🇷 181.116.220.27

🇺🇸 172.253.194.145

🇸🇬 168.144.134.137

🇨🇳 119.51.242.3

🇷🇺 95.71.62.117

🇪🇸 68.221.69.72

🇺🇸 64.113.5.7

🇧🇷 45.205.1.242

🇰🇿 37.208.46.133

🇺🇸 34.58.124.191

🇺🇸 193.3.53.9

🇺🇸 104.223.54.22

🇫🇷 91.231.89.109

🇳🇱 45.148.10.151

🇯🇵 43.153.150.130

🇹🇼 35.201.233.251

🇰🇷 14.46.87.209

🇲🇦 196.92.7.249