JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

196.189.154.107

Activity Trending Down

Abuse Confidence Score

57% Elevated

37 reports

26 reporters · latest 2 weeks ago

ISP: Ethio Telecom
Usage Type: Fixed Line ISP
ASN: AS24757
Domain Name: ethiotelecom.et
Country: 🇪🇹 Ethiopia
City: Addis Ababa, Addis Ababa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

37 from 26 distinct reporters

First reported

September 20th 2025

Most recent report

2 weeks ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 10 🇩🇪 Germany 6 🇫🇷 France 2

Most common categories Web App Attack 15 Brute-Force 7 Bad Web Bot 6 Hacking 4 Port Scan 3

Old reports The most recent abuse report for this IP address is from 2 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇿 akac	2026-10-15 10:03:17 (2 weeks ago)	Web vulnerability scanning: HTTP/1.1 POST /xmlrpc.php	Hacking Brute-Force Bad Web Bot Web App Attack
🇯🇵 rafale2k	2026-10-13 08:53:10 (2 weeks ago)	WordPress Brute Force	Brute-Force Web App Attack
🇺🇸 rafaelpfister.ch	2026-10-13 08:45:24 (2 weeks ago)	Blocked by WAF: 1 request(s) probing for PHP scripts, WordPress files or secrets on a site without PHP: POST /xmlrpc.php • Reported by: github.com/pfstr/cloudflare-abuseipdb-reporter	Web App Attack
🇫🇮 YF	2026-10-12 07:00:44 (2 weeks ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force
🇬🇧 gigatech	2026-10-10 19:15:04 (2 weeks ago)	Webserver Probing	Web App Attack
🇳🇱 Alt255	2026-10-10 16:22:30 (2 weeks ago)	[ti-02ra] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 196.189.154.107 - - [10/Oct/2026:18:17:36 +0200] "POST /xmlrpc.php HTTP/1.1" 404 93523 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebK ... show more [ti-02ra] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 196.189.154.107 - - [10/Oct/2026:18:17:36 +0200] "POST /xmlrpc.php HTTP/1.1" 404 93523 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/13.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:18:20:42 +0200] "POST /xmlrpc.php HTTP/1.1" 404 93471 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:18:21:42 +0200] "POST /xmlrpc.php HTTP/1.1" 301 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/89.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:18:22:19 +0200] "POST /xmlrpc.php HTTP/1.1" 404 93523 "-" "Mozilla/5.0 (X11; Ub ... show less	Brute-Force Web App Attack
🇺🇸 IndigoRidge	2026-10-10 06:43:22 (2 weeks ago)	196.189.154.107 - - [10/Oct/2026:02:41:17 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 15880 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [10/Oct/2026:02:41:58 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" " ... show more 196.189.154.107 - - [10/Oct/2026:02:41:17 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 15880 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [10/Oct/2026:02:41:58 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/98.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:02:42:26 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:02:42:53 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" 196.189.154.107 - - [10/Oct/2026:02:43:21 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/61.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 security.rdmc.fr	2026-10-09 11:17:10 (3 weeks ago)	Port Scan Attack proto:TCP src:6356 dst:23	Port Scan
🇺🇸 IndigoRidge	2026-10-09 09:40:58 (3 weeks ago)	196.189.154.107 - - [09/Oct/2026:05:36:37 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:05:39:31 -0400] "GE ... show more 196.189.154.107 - - [09/Oct/2026:05:36:37 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:05:39:31 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 15880 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [09/Oct/2026:05:40:03 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:05:40:29 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/71.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:05:40:57 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5162 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/76.0.0.0 Safari/537.36" ... show less	Web App Attack
🇫🇷 tecnoacquisti.com	2026-10-09 07:35:27 (3 weeks ago)	PrestaShop Security Module: WordPress probe path detected	Web App Attack
🇺🇸 IndigoRidge	2026-10-09 05:00:13 (3 weeks ago)	196.189.154.107 - - [09/Oct/2026:00:57:39 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 5805 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [09/Oct/2026:00:58:24 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "M ... show more 196.189.154.107 - - [09/Oct/2026:00:57:39 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 5805 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [09/Oct/2026:00:58:24 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/60.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:00:59:08 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:00:59:40 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/99.0.0.0 Safari/537.36" 196.189.154.107 - - [09/Oct/2026:01:00:12 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36" ... show less	Web App Attack
🇺🇸 IndigoRidge	2026-10-08 18:13:21 (3 weeks ago)	196.189.154.107 - - [08/Oct/2026:14:09:37 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36" 196.189.154.107 - - [08/Oct/2026:14:12:06 ... show more 196.189.154.107 - - [08/Oct/2026:14:09:37 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36" 196.189.154.107 - - [08/Oct/2026:14:12:06 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 200 5805 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" 196.189.154.107 - - [08/Oct/2026:14:12:35 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.0.0 Safari/537.36" 196.189.154.107 - - [08/Oct/2026:14:13:00 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Safari/11.0.0.0 Safari/537.36" 196.189.154.107 - - [08/Oct/2026:14:13:21 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5122 "-" "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" ... show less	Web App Attack
Anonymous	2026-10-06 06:48:05 (3 weeks ago)	(wordpress) Failed wordpress login from 196.189.154.107 (ET/Ethiopia/Addis Ababa/Addis Ababa/-/[redacted])	Brute-Force
🇩🇪 Marc	2026-10-05 12:06:39 (3 weeks ago)	196.189.154.107 - - [05/Oct/2026:14:01:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4808 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/80.0.0.0 Safari/537.36" 196.189.154.107 - - [05/Oct/2026:14:05:50 +0200] "POS ... show more 196.189.154.107 - - [05/Oct/2026:14:01:42 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4808 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/80.0.0.0 Safari/537.36" 196.189.154.107 - - [05/Oct/2026:14:05:50 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4856 "-" "Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/88.0.0.0 Safari/537.36" 196.189.154.107 - - [05/Oct/2026:14:06:38 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4855 "-" "Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/86.0.0.0 Safari/537.36" show less	Brute-Force Web App Attack
🇩🇪 LRob	2026-10-05 04:43:27 (3 weeks ago)	WordPress attack-tool calls \| method: POST \| path: /xmlrpc.php \| ua: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 \| 2026-10-05 04:43 UTC	Web App Attack Hacking

Showing 1 to 15 of 37 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 195.184.76.153

🇺🇸 185.180.141.15

🇺🇸 185.88.102.207

🇨🇭 179.43.153.10

🇺🇸 68.10.53.87

🇳🇱 45.156.87.72

🇬🇧 45.135.142.179

🇺🇸 199.165.159.215

🇺🇸 199.165.159.205

🇺🇸 173.0.84.2

🇧🇷 137.131.248.20

🇧🇷 136.248.121.226

🇺🇸 129.121.114.62

🇺🇸 104.243.133.18

🇳🇱 77.67.26.23

🇸🇬 47.84.139.248

🇧🇷 45.183.21.207

🇦🇿 37.61.117.239

🇧🇷 205.210.31.241

🇺🇸 199.165.159.25