JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 138.0.245.179

138.0.245.179 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 56%: ?

56%

ISP	AGE TELECOMUNICACOES LTDA
Usage Type	Fixed Line ISP
ASN	AS271689
Hostname(s)	138.0.245.180.IN-ADDR-ARPA
Domain Name	agetelecom.com.br
Country	🇧🇷 Brazil
City	Brasilia, Federal District

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 138.0.245.179

Whois 138.0.245.179

IP Abuse Reports for 138.0.245.179:

This IP address has been reported a total of 28 times from 19 distinct sources. 138.0.245.179 was first reported on February 5th 2024, and the most recent report was 12 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 cwytech	2026-08-22 08:59:39 (12 hours ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.	Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-14 03:04:52 (1 week ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇩🇪 EGP Abuse Dept	2026-08-06 01:42:01 (2 weeks ago)	Scraping webshop URLs (www.ngs.nl), likely botnet drone	Bad Web Bot Exploited Host
🇺🇸 TPI-Abuse	2026-08-04 09:52:46 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 04 05:52:41.111968 2026] [security2:error] [pid 1907720:tid 1907720] [client 138.0.245.179:42832] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.0.245.179 (+1 hits since last alert)\|yerevanpress.am\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "yerevanpress.am"] [uri "/xmlrpc.php"] [unique_id "anG2aRdMysLM9oHBvMaD0wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-04 05:19:52 (2 weeks ago)	Repeated wp-login/xmlrpc attempts	Brute-Force SSH
🇩🇪 ger-stg-sifi1	2026-08-04 01:12:08 (2 weeks ago)	(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php	Web App Attack
🇺🇸 TPI-Abuse	2026-08-04 00:47:18 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 20:47:13.801584 2026] [security2:error] [pid 2155084:tid 2155084] [client 138.0.245.179:42918] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.0.245.179 (+1 hits since last alert)\|robinsnestingplace.net\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "robinsnestingplace.net"] [uri "/xmlrpc.php"] [unique_id "anE2kf-sAEq3uygHuXMiMAAAABg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 21:31:58 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 17:31:54.653464 2026] [security2:error] [pid 335232:tid 335255] [client 138.0.245.179:42130] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.0.245.179 (+1 hits since last alert)\|woofnrose.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "woofnrose.com"] [uri "/xmlrpc.php"] [unique_id "anEIyjn6i5lXIaBGu8zRrgAAAJA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-03 20:55:22 (2 weeks ago)	[redacted] 138.0.245.179 - - [03/Aug/2026:22:54:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "W ... show more [redacted] 138.0.245.179 - - [03/Aug/2026:22:54:40 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 138.0.245.179 - - [03/Aug/2026:22:54:50 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "WordPress.com; https://wordpress.com" [redacted] 138.0.245.179 - - [03/Aug/2026:22:55:02 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com" [redacted] 138.0.245.179 - - [03/Aug/2026:22:55:11 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.3)" [redacted] 138.0.245.179 - - [03/Aug/2026:22:55:22 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Jetpack by WordPress.com (Jetpack 12.0; WordPress 6.4)" ... show less	Hacking Web App Attack
🇨🇭 Mario Bretscher	2026-08-03 20:24:16 (2 weeks ago)	Aug 3 22:24:01 beat-band.ch Cerber(beat-band.ch)[3446088]: Authentication failure for beat-band from ... show more Aug 3 22:24:01 beat-band.ch Cerber(beat-band.ch)[3446088]: Authentication failure for beat-band from 138.0.245.179 Aug 3 22:24:14 beat-band.ch Cerber(beat-band.ch)[3450253]: Authentication failure for beat-band from 138.0.245.179 ... show less	Web Spam
🇫🇷 dynamix	2026-08-03 16:58:37 (2 weeks ago)	WordPress XMLRPC Brute Force Attack	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-08-03 16:32:38 (2 weeks ago)	(mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 i ... show more (mod_security) mod_security (id:240335) triggered by 138.0.245.179 (138.0.245.180.IN-ADDR-ARPA): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 03 12:32:32.043951 2026] [security2:error] [pid 27215:tid 27215] [client 138.0.245.179:42714] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 138.0.245.179 (+1 hits since last alert)\|celebritybikinigossip.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "celebritybikinigossip.com"] [uri "/xmlrpc.php"] [unique_id "anDCoJck0_hNxSG1DhXjUQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-08-03 16:20:37 (2 weeks ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-08-03 15:56:26 (2 weeks ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇫🇮 YF	2026-08-03 09:30:29 (2 weeks ago)	xmlrpc.php Potential DDoS or brute force	DDoS Attack Brute-Force

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.154.115

🇬🇧 195.96.139.146

🇺🇸 192.81.208.138

🇦🇹 159.195.115.91

🇭🇰 152.32.215.224

🇳🇱 91.92.42.19

🇬🇧 35.203.211.232

🇬🇧 2a09:bac1:28a0:840::319:f0

🇦🇷 190.48.243.41

🇸🇾 185.134.132.70

🇺🇸 172.71.223.142

🇭🇰 124.244.107.112

🇰🇷 115.178.75.243

🇨🇳 110.249.202.94

🇮🇩 103.159.199.43

🇳🇱 89.248.172.12

🇦🇿 31.171.125.179

🇦🇺 3.26.6.232

🇷🇴 2.57.122.53

🇦🇺 223.27.18.80