145.241.125.113

Record

Score

32/100each request counts half as much after 30 days

Worst level

Brute

Attack-shaped requests

25all time

Active days

3UTC days

First seen

8 Oct 2026

Last seen

10 Oct 2026 01:17

Servers hit

2

Targets

6sites

Times blocked

1by the evidence rules

Its traffic probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface; it also requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods; it also requested wp-login.php to check whether this site runs WordPress.

Surfaces: web-app. Attack types: password spraying, scanning. Seen by: web.

Activity, last 90 days

Active on 3 of the last 90 UTC days. Current block: 10 Oct 2026 to 8 Jan 2027.

0 1–9 10–99 100–999 1,000+ block window

• At least 4 requests a minute at its peak (9 Oct 2026 23:20 UTC; identical requests in the same second are stored once).
• Methods: GET 25.
• The servers we watch answered: 404 24, 301 1 (totals only, from our web servers).

Evidence

Newest first, the latest 50 stored requests grouped into runs. Times are UTC. The user agent is shown as its family only.

Network

ASN

AS31898 Oracle Corporation

Network type

cloud

Reverse DNS

none

Country

United Arab Emirates AE

City

Dubai (registry location of a hosting network)

Flags

none observed

Abuse contact

found in the registry

Checked

8 Oct 2026

Elsewhere: GreyNoise, Shodan, AbuseIPDB.