Report for IP: 45.154.98.134

Threat LevelHIGH54/1002 rule types across 2 attack categories
10 incidents · 2 rule types · confirmed on global blocklist · persistent 9-day campaign · last seen 20d ago
PTR 45.154.98.134.powered.by.rdp.sh
Org / ASN 1337 Services GmbH
Country 🇳🇱 The Netherlands
City Lelystad, Flevoland
Timezone Europe/Amsterdam

Attack Analysis

🇳🇱 Netherlands · Amsterdam · 210558 · 1 Services GmbH
IDS: Blocklist — Spamhaus DROP
This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.
WordPress XML-RPC Abuse
This IP targeted xmlrpc.php, a legacy WordPress endpoint that has been abused for brute-force authentication attacks, credential stuffing, and DDoS amplification. Any direct access to xmlrpc.php is an attack or reconnaissance attempt; modern WordPress sites should disable it entirely.

Reports (10)

Date Severity Description
12 Jul 2026 - 01:11 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
12 Jul 2026 - 01:11 high IDS: Blocklist — Spamhaus DROP listed IP
11 Jul 2026 - 03:41 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
10 Jul 2026 - 19:00 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
10 Jul 2026 - 06:23 high IDS: Blocklist — Spamhaus DROP listed IP
10 Jul 2026 - 06:23 high Web: xmlrpc.php accessed
10 Jul 2026 - 06:23 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
3 Jul 2026 - 22:18 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
3 Jul 2026 - 10:37 high Web: xmlrpc.php accessed
3 Jul 2026 - 10:26 high IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7