JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.8.96.71

204.8.96.71 was found in our database!

This IP was reported 118 times. Confidence of Abuse is 54%: ?

54%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Quintex Alliance Consulting
Usage Type	Data Center/Web Hosting/Transit
ASN	AS62744
Hostname(s)	tor48.quintex.com
Domain Name	quintex.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.8.96.71

Whois 204.8.96.71

IP Abuse Reports for 204.8.96.71:

This IP address has been reported a total of 118 times from 48 distinct sources. 204.8.96.71 was first reported on April 23rd 2024, and the most recent report was 4 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 nowyouknow	2026-07-22 12:20:40 (4 hours ago)	(From [email protected]) u8yeg5	Phishing Web Spam
🇸🇬 securejdprop	2026-07-21 03:26:21 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 80). show less	Hacking Web App Attack
🇮🇩 securejdprop	2026-07-21 02:47:12 (1 day ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor R ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 77). show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 14:26:00 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210730) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 10:25:52.388536 2026] [security2:error] [pid 18216:tid 18216] [client 204.8.96.71:32912] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|test.nationalccl.com\|F\|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "test.nationalccl.com"] [uri "/blog/wp-json/oembed/1.0/biztalkhttpreceive.dll"] [unique_id "al4v8FMhImnXxRy9Wi8dXwAAACg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 17:44:49 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 13:44:45.967484 2026] [security2:error] [pid 1996547:tid 1996547] [client 204.8.96.71:34764] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.mvpbees.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mvpbees.com"] [uri "/robots.txt"] [unique_id "al0NDQdUxl4empbHJp8jaAAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 10:05:09 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 204.8.96.71 (tor48.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 06:05:05.190350 2026] [security2:error] [pid 1917:tid 1917] [client 204.8.96.71:53540] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.register-yacht-croatia.com\|F\|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.register-yacht-croatia.com"] [uri "/robots.txt"] [unique_id "alyhUV1NRZiAJFjvhec5OgAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 nowyouknow	2026-07-18 12:07:21 (4 days ago)	(From [email protected]) TPBUYLEyGTSuzWTvyN	Phishing Web Spam
Anonymous	2026-07-17 10:08:46 (5 days ago)	Detected by CrowdSec: crowdsecurity/http-bad-user-agent	Web App Attack
🇺🇸 xmission.com	2026-07-13 20:02:10 (1 week ago)	Blocked by UFW (TCP on 43704) Source port: 445 TTL: 54 Packet length: 76 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 43704) Source port: 445 TTL: 54 Packet length: 76 TOS: 0x08 This report (for 204.8.96.71) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇺 screwlooseit.com.au	2026-07-10 10:06:50 (1 week ago)	Blocked by CSF 13 firewall - Rule: WPLOGIN US/United States/tor48.quintex.com	Web App Attack
🇫🇷 dynamix	2026-07-09 23:42:13 (1 week ago)	Multiple WAF Violations	Web App Attack
🇬🇧 consul.to	2026-07-08 10:58:37 (2 weeks ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 IVski	2026-07-06 14:44:13 (2 weeks ago)	IVski WAF \| Affiliate/scam landing path scan	Port Scan Brute-Force Web App Attack
Anonymous	2026-07-02 12:01:16 (2 weeks ago)	2026-07-02 04:01:03,606 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 2026-07-02 ... show more 2026-07-02 04:01:03,606 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 2026-07-02 07:00:30,845 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 2026-07-02 10:00:23,950 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 2026-07-02 13:00:16,934 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 2026-07-02 15:01:01,307 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.71 show less	Brute-Force
🇺🇸 canine.tools	2024-12-10 13:48:59 (1 year ago)	[fail2ban Auto Report] searxng search spam abuse	Port Scan Brute-Force

Showing 1 to 15 of 118 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 223.123.16.238

🇦🇫 149.54.81.38

🇨🇳 114.250.44.173

🇺🇸 85.254.125.202

🇺🇸 65.49.1.28

🇺🇸 2a09:bac1:76c0:480::11:1c0

🇷🇺 212.3.155.8

🇮🇷 194.5.176.86

🇧🇷 187.58.79.28

🇨🇷 143.202.162.196

🇮🇳 112.196.183.131

🇰🇷 112.168.121.39

🇹🇼 110.25.112.152

🇩🇪 69.5.169.13

🇺🇸 45.159.21.56

🇺🇸 45.38.249.157

🇨🇳 182.61.22.188

🇳🇱 173.194.170.83

🇺🇸 166.88.217.179

🇫🇷 137.74.118.45