This IP address has been reported a total of
9
times from
9 distinct
sources.
136.112.149.104 was first reported on
October 21st 2026 , and the most recent report was
2 days ago Germany
with 2
reports;
Spain
with 1
report;
Finland
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Brute-Force
3
times;
Bad Web Bot
2
times;
Exploited Host
1
time;
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇲🇽
octageeks.com
2026-10-22 04:28:18
(2 days ago)
Wordpress malicious attack:[octamissingdomain]
Web App Attack
🇺🇸
IndigoRidge
2026-10-21 17:23:18
(3 days ago)
136.112.149.104 - - [21/Oct/2026:13:23:16 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 47 ...
show more
136.112.149.104 - - [21/Oct/2026:13:23:16 -0400] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 301 4769 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
136.112.149.104 - - [21/Oct/2026:13:23:16 -0400] "GET //xmlrpc.php?rsd HTTP/1.1" 200 5401 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
136.112.149.104 - - [21/Oct/2026:13:23:17 -0400] "GET //?author=1 HTTP/1.1" 301 4751 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
136.112.149.104 - - [21/Oct/2026:13:23:17 -0400] "GET //?author=2 HTTP/1.1" 301 4751 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
136.112.149.104 - - [21/Oct/2026:13:23:17 -0400] "GET //wp-json/wp/v2/users/ HTTP/1.1" 200 16959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
...
show less
Web App Attack
🇪🇸
pipeline.es
2026-10-21 17:22:20
(3 days ago)
WordPress login brute-force | URL: https://ceav.info//xmlrpc.php | Evidence: {\"integration\":\"word ...
show more
WordPress login brute-force | URL: https://ceav.info//xmlrpc.php | Evidence: {\"integration\":\"wordfence\",\"ts\":\"2026-10-21T17:19:17Z\",\"action\":\"blocked:wfsn\",\"description\":\"Blocked by Wordfence Security Network\",\"srcip\":\"136.112.149.104\",\"status_code\":503,\"url\":\"https://ceav.info//xmlrpc.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\",\"wfid\":4740025} | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Brute-Force
🇫🇷
Jean Valjean
2026-10-21 17:22:18
(3 days ago)
Fail2ban Caboom : wp-login.php Bruteforce
Brute-Force
Web App Attack
🇮🇹
VHosting
2026-10-21 17:20:03
(3 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-10-21 17:18:30
(3 days ago)
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 136.112.149.104 (US/United States/104.149.112. ...
show more
(wp_fingerprint) REGOLA 6 - WP Exploit Attempt xmlrpc 136.112.149.104 (US/United States/104.149.112.136.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 136.112.149.104 - - [21/Oct/2026:19:18:25 +0200] "GET //wp-json/wp/v2/users/ HTTP/1.1" 200 650 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "-" host=alessandradamato.com
show less
Port Scan
🇩🇪
FeG Deutschland
2026-10-21 17:18:02
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇺🇦
Olexiy Backend
2026-10-21 16:48:12
(3 days ago)
136.112.149.104
...
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-10-21 16:39:52
(3 days ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
Showing 1 to
9
of 9 reports
