This IP address has been reported a total of
14
times from
14 distinct
sources.
136.109.138.213 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
Automated web scanner. Requested suspicious paths: //2019/wp-includes/wlwmanifest.xml | //xmlrpc.php ...
show moreAutomated web scanner. Requested suspicious paths: //2019/wp-includes/wlwmanifest.xml | //xmlrpc.php | //wp-includes/ID3/license.txt | //2020/wp-includes/wlwmanifest.xml | //blog/wp-includes/wlwmanifest.xml | //web/wp-includes/wlwmanifest.xml | //shop/wp-includes/wlwmanifest.xml | //wp/wp-includes/wlwmanifest.xml | //wordpress/wp-includes/wlwmanifest.xml | //wp1/wp-includes/wlwmanifest.xml | //cms/wp-includes/wlwmanifest.xml | //site/wp-includes/wlwmanifest.xml | //test/wp-includes/wlwmanifest.xml | //2021/wp-includes/wlwmanifest.xml. UTC: 2026-07-22 11:46:52.
show less
http-probing - IP: 136.109.138.213 - time="2026-07-22T14:05:31+02:00" level=info msg="(555f66b4f6a7 ...
show morehttp-probing - IP: 136.109.138.213 - time="2026-07-22T14:05:31+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-probing by ip 136.109.138.213 (US/396982) : 4h ban on Ip 136.109.138.213" module=db
show less
(wordpress) Failed wordpress login from 136.109.138.213 (US/United States/Oregon/The Dalles/213.138. ...
show more(wordpress) Failed wordpress login from 136.109.138.213 (US/United States/Oregon/The Dalles/213.138.109.136.bc.googleusercontent.com)
show less
{"ClientAddr":"136.109.138.213:50735","ClientHost":"136.109.138.213","ClientPort":"50735","ClientUse ...
show more{"ClientAddr":"136.109.138.213:50735","ClientHost":"136.109.138.213","ClientPort":"50735","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":53420,"GzipRatio":0,"OriginContentSize":0,"OriginDuration":0,"OriginStatus":0,"Overhead":53420,"RequestAddr":"arango.vdkln.com","RequestContentSize":0,"RequestCount":85865,"RequestHost":"arango.vdkln.com","RequestMethod":"GET","RequestPath":"/wp-includes/ID3/license.txt","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"StartLocal":"2026-07-22T11:49:35.106594832Z","StartUTC":"2026-07-22T11:49:35.106594832Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-07-22T11:49:35Z"}
{"ClientAddr":"136.109.138.213:61728","ClientHost":"136.109.138.213","ClientPort":"61728","ClientUsername":"-","DownstreamContentSize":19,"DownstreamStatus":404,"Duration":62493,"GzipRatio":0,"OriginContentSize":0,"OriginD
...
show less
Automated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp-includes/ID3/license.t ...
show moreAutomated web credential/secret scanner blocked by Fail2Ban. Probed: "GET /wp-includes/ID3/license.txt HTTP/1.1"
show less
Web App Attack
Bad Web Bot
Showing 1 to
14
of 14 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩