JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

45.182.118.20

Activity Trending Down

Abuse Confidence Score

96% Critical

49 reports

39 reporters · latest 1 week ago

ISP: UNIVERSIDAD TECNOLÓGICA INDOAMERICA
Usage Type: University/College/School
ASN: AS269792
Domain Name: uti.edu.ec
Country: 🇪🇨 Ecuador
City: Ambato, Tungurahua Province

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

49 from 39 distinct reporters

First reported

January 30th 2023

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇩🇪 Germany 18 🇺🇸 United States of America 7 🇳🇱 Netherlands 5

Most common categories Web App Attack 31 Brute-Force 20 Hacking 9 Port Scan 7 Bad Web Bot 5

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 BlueStem123	2026-10-22 12:00:35 (1 week ago)	Automated scanner targeting WordPress installations. Source produced sustained scanning activity exceeding 100 requests within a 60-minute window.	Bad Web Bot Web App Attack
🇳🇱 MM-bot	2026-10-21 21:02:36 (1 week ago)	URL-probe: HTTP/1.1 POST request on /xmlrpc.php (2026-10-21 23:02:36 UTC+2)	Web App Attack Hacking
🇩🇪 4server	2026-10-21 18:33:05 (1 week ago)	[WedOct2120:33:03.0682752026][security2:error][pid97723:tid97813][client45.182.118.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"9600 ... show more [WedOct2120:33:03.0682752026][security2:error][pid97723:tid97813][client45.182.118.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"autoeuro.lv\"][uri\"/xmlrpc.php\"][unique_id\"atkFX5nju-VGSoFM4AJXpQAAAI8\"] show less	Port Scan Brute-Force Web App Attack
🇧🇷 radardatelecom	2026-10-21 14:18:03 (1 week ago)	Blocked by Radar da Telecom firewall — abuseipdb	Bad Web Bot Web App Attack
🇫🇷 security.rdmc.fr	2026-10-21 14:09:18 (1 week ago)	SQL Injection Attempts	SQL Injection
🇳🇱 Site.eu	2026-10-21 06:11:20 (1 week ago)	Suspicious multiple login attempts	Brute-Force SSH
🇺🇸 WellSpring	2026-10-20 04:46:24 (2 weeks ago)	xmlrpc exploit on sammamish.online/xmlrpc.php — WellSpr.ing/NetSentinel civic-AI security layer	Brute-Force Web App Attack
Anonymous	2026-10-20 03:10:02 (2 weeks ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇩🇪 4server	2026-10-20 02:40:51 (2 weeks ago)	[TueOct2004:40:44.9075802026][security2:error][pid1903170:tid1903260][client45.182.118.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ... show more [TueOct2004:40:44.9075802026][security2:error][pid1903170:tid1903260][client45.182.118.20:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"morgenstern-swiss.ch\"][uri\"/xmlrpc.php\"][unique_id\"atbUrLywwcvDTx_HnoIU_wAAAQM\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Alt255	2026-10-19 21:45:09 (2 weeks ago)	[cb-03al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 45.182.118.20 - - [19/Oct/2026:23:44:42 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5658 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit ... show more [cb-03al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 45.182.118.20 - - [19/Oct/2026:23:44:42 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5658 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/10.0.0.0 Safari/537.36" 45.182.118.20 - - [19/Oct/2026:23:44:45 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5655 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/92.0.0.0 Safari/537.36" 45.182.118.20 - - [19/Oct/2026:23:44:48 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5651 "-" "Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/79.0.0.0 Safari/537.36" 45.182.118.20 - - [19/Oct/2026:23:44:50 +0200] "POST /xmlrpc.php HTTP/1.1" 301 5649 "-" " ... show less	Brute-Force Web App Attack
Anonymous	2026-10-19 14:41:43 (2 weeks ago)	Web attack blocked by WAF: POST /xmlrpc.php, GET /wp-json/wp/v2/users (WordPress XML-RPC access attempt; XMLRPC fault response). [19/Oct/2026:17:39:25 +0300] "POST /xmlrpc.php HTTP/1.1" UA="Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, ... show more Web attack blocked by WAF: POST /xmlrpc.php, GET /wp-json/wp/v2/users (WordPress XML-RPC access attempt; XMLRPC fault response). [19/Oct/2026:17:39:25 +0300] "POST /xmlrpc.php HTTP/1.1" UA="Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox" -> WordPress XML-RPC access attempt; XMLRPC fault response [19/Oct/2026:17:41:42 +0300] "GET /wp-json/wp/v2/users HTTP/1.1" UA="Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)" -> Monitoring WordPress 5.3 User Enumeration attempts; Possible WordPress Dashboard access for infectors show less	Web App Attack
Anonymous	2026-10-17 13:39:21 (2 weeks ago)	(wordpress) Failed wordpress login from 45.182.118.20 (EC/Ecuador/-)	Brute-Force
🇩🇪 Vegascosmetics	2026-10-17 13:35:14 (2 weeks ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: /[a-z0-9]{1,12}\.php (Match: /xmlrpc.php)	Hacking Exploited Host Web App Attack
🇩🇪 pscriptos	2026-10-16 09:33:34 (2 weeks ago)	{"ClientAddr":"45.182.118.20:64494","ClientHost":"45.182.118.20","ClientPort":"64494","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":161154240,"OriginContentSize":418,"OriginDuration":157160104,"OriginStatus":403," ... show more {"ClientAddr":"45.182.118.20:64494","ClientHost":"45.182.118.20","ClientPort":"64494","ClientUsername":"-","DownstreamContentSize":418,"DownstreamStatus":403,"Duration":161154240,"OriginContentSize":418,"OriginDuration":157160104,"OriginStatus":403,"Overhead":3994136,"RequestAddr":"www.cleveradmin.de","RequestContentSize":680,"RequestCount":2804508,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-10-16T11:30:02.900447043+02:00","StartUTC":"2026-10-16T09:30:02.900447043Z","TLSCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLSVersion":"1.2","entryPointName":"websecure","level":"info","msg":"","time":"2026-10-16T11:30:03+02:00"} {"ClientAddr":"45.182.118.20:49859","ClientHost":"45.182.118.20"," ... show less	Brute-Force Web App Attack
Anonymous	2026-10-16 05:24:18 (2 weeks ago)	WordPress login / xmlrpc probing across multiple sites	Web App Attack

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇮🇩 210.79.142.203

🇺🇸 209.6.226.104

🇹🇼 198.235.24.28

🇿🇦 196.41.207.112

🇳🇱 195.178.110.30

🇪🇸 194.156.155.240

🇨🇱 190.5.43.170

🇺🇸 189.104.7.75

🇧🇷 187.16.96.250

🇨🇱 186.107.21.122

🇺🇸 173.255.210.89

🇺🇸 173.56.198.147

🇺🇸 172.252.204.160

🇺🇸 172.245.107.216

🇺🇸 170.23.5.158

🇺🇸 154.47.22.74

🇳🇱 138.226.239.11

🇨🇳 114.66.42.81

🇨🇭 84.74.163.210

🇬🇧 82.21.211.69