JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 204.8.96.72

204.8.96.72 was found in our database!

This IP was reported 208 times. Confidence of Abuse is 28%: ?

28%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Quintex Alliance Consulting
Usage Type	Commercial
ASN	AS62744
Hostname(s)	tor49.quintex.com
Domain Name	quintex.com
Country	🇺🇸 United States of America
City	Dallas, Texas

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 204.8.96.72

Whois 204.8.96.72

IP Abuse Reports for 204.8.96.72:

This IP address has been reported a total of 208 times from 62 distinct sources. 204.8.96.72 was first reported on April 15th 2024, and the most recent report was 18 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-07-14 16:40:37 (18 hours ago)	Blocked by UFW (TCP on 44170) Source port: 443 TTL: 54 Packet length: 76 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 44170) Source port: 443 TTL: 54 Packet length: 76 TOS: 0x08 This report (for 204.8.96.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-14 03:53:51 (1 day ago)	Blocked by UFW (TCP on 60952) Source port: 445 TTL: 54 Packet length: 52 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 60952) Source port: 445 TTL: 54 Packet length: 52 TOS: 0x08 This report (for 204.8.96.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-13 12:41:46 (1 day ago)	Blocked by UFW (TCP on 51618) Source port: 444 TTL: 54 Packet length: 76 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 51618) Source port: 444 TTL: 54 Packet length: 76 TOS: 0x08 This report (for 204.8.96.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 xmission.com	2026-07-12 00:28:36 (3 days ago)	Blocked by UFW (TCP on 39850) Source port: 444 TTL: 54 Packet length: 76 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 39850) Source port: 444 TTL: 54 Packet length: 76 TOS: 0x08 This report (for 204.8.96.72) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇱🇻 garmtech.com	2026-07-11 01:31:30 (4 days ago)	IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js ... show more IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478) show less	Hacking
🇮🇩 securejdprop	2026-07-09 07:16:19 (6 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor E ... show more This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET TOR Known Tor Exit Node Traffic group 78). Ip 204.8.96.72 performed 'crowdsecurity/suricata-major-severity' (1 events over 0s) at 2026-07-09 07:16:17.699264864 +0000 UTC show less	Hacking Web App Attack
Anonymous	2026-07-02 12:01:17 (1 week ago)	2026-07-02 04:01:03,648 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 2026-07-02 ... show more 2026-07-02 04:01:03,648 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 2026-07-02 07:00:30,888 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 2026-07-02 10:00:23,993 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 2026-07-02 13:00:16,979 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 2026-07-02 15:01:01,399 fail2ban.actions [3625835]: NOTICE [tor] Ban 204.8.96.72 show less	Brute-Force
🇺🇸 gu-alvareza	2026-02-14 07:05:10 (5 months ago)	Muscat.Path.Disclosure	Web App Attack
🇺🇸 gu-alvareza	2026-02-13 07:05:09 (5 months ago)	Cross.Site.Scripting	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-02-11 06:55:17 (5 months ago)	(mod_security) mod_security (id:225170) triggered by 204.8.96.72 (tor49.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:225170) triggered by 204.8.96.72 (tor49.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 01:55:03.095198 2026] [security2:error] [pid 20524:tid 20524] [client 204.8.96.72:39280] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|bigholegolf.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "bigholegolf.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aYwnxpA67BrqzZHO0IN60QAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 Origon	2026-02-07 13:03:24 (5 months ago)	http-bad-user-agent - IP: 204.8.96.72 - time="2026-02-07T14:03:24+01:00" level=info msg="(555f66b4f ... show more http-bad-user-agent - IP: 204.8.96.72 - time="2026-02-07T14:03:24+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 204.8.96.72 (US/62744) : 4h ban on Ip 204.8.96.72" module=db show less	Bad Web Bot
🇺🇸 myagent.site	2026-02-07 06:20:48 (5 months ago)	Blocking for trying to access an exploit file: /myagent.site	Hacking
🇺🇸 TPI-Abuse	2026-02-05 05:51:05 (5 months ago)	(mod_security) mod_security (id:210350) triggered by 204.8.96.72 (tor49.quintex.com): 1 in the last ... show more (mod_security) mod_security (id:210350) triggered by 204.8.96.72 (tor49.quintex.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 00:50:57.149354 2026] [security2:error] [pid 13161:tid 13161] [client 204.8.96.72:48350] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|cyberclay.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cyberclay.net"] [uri "/xmlrpc.php"] [unique_id "aYQvwW8fECbksbd2obXvWgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 gu-alvareza	2026-02-02 07:05:09 (5 months ago)	ThinkPHP.Controller.Parameter.Remote.Code.Execution	Hacking Web App Attack
🇺🇸 gu-alvareza	2026-02-01 07:05:04 (5 months ago)	Generic.Path.Traversal.Detection	Port Scan

Showing 1 to 15 of 208 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇿 212.47.136.7

🇮🇩 180.247.58.50

🇮🇳 119.18.48.74

🇨🇳 106.12.51.76

🇮🇳 98.70.48.241

🇷🇴 92.118.39.205

🇬🇧 81.86.182.211

🇫🇷 79.93.26.50

🇺🇸 66.132.186.222

🇨🇳 62.234.33.244

🇧🇷 20.226.66.230

🇨🇳 14.22.23.243

🇷🇴 2.57.122.209

🇺🇸 2a09:bac1:76a0:460::5e:6f

🇨🇦 174.112.4.201

🇭🇰 172.71.214.52

🇺🇸 52.146.9.202

🇲🇾 47.250.160.122

🇳🇱 45.148.10.157

🇨🇳 14.103.115.115