Substantial Risk
IP address 169.150.203.197 is a high-risk address assessed at 8/10 threat level, operated by Datacamp Limited (AS212238) in the United States, with 318 abuse reports logged between November 2025 and May 2026. The dominant activity consists of coordinated WordPress-focused web application attacks including xmlrpc exploitation, user enumeration, configuration probing, and REST API abuse, detected primarily through automated honeypot sensors and corroborated by community reports.
The evidence base comprises 318 total reports sourced from 18 automated honeypot sensors and 2 community submissions, yielding a 76% confidence score. Attack pattern analysis reveals systematic WordPress reconnaissance: the IP executed over 50 Fail2ban-triggering xmlrpc attacks, attempted author-based user enumeration via query parameters, scanned for configuration file exposure, and triggered WordPress REST API probes and unauthorized cron execution attempts. Despite a modest activity frequency rating of 1/10, the sustained six-month reporting window and concentration of identical WordPress targeting techniques across multiple sensors indicate persistent, automated exploitation infrastructure rather than opportunistic scanning.
Web application attacks against WordPress deployments represent a concrete real-world threat because they exploit predictable application structures and default endpoints to harvest user credentials, enumerate administrative accounts, and ultimately achieve unauthorized access or site compromise. The xmlrpc vector enables credential stuffing and brute-force amplification, while author enumeration and REST API abuse facilitate information disclosure that attackers use to craft targeted follow-on payloads. When combined with config file scanning and cron manipulation attempts, these techniques form a comprehensive exploitation pipeline that can result in complete site takeover, data exfiltration, or weaponization for further attacks.
Site operators running WordPress should implement explicit blocking or rate-limiting for IP addresses with this reputation profile. Deploying Fail2ban with wordpress-escalation filters or equivalent intrusion prevention rules will automatically mitigate xmlrpc and brute-force patterns. Harden WordPress REST API exposure by requiring authentication for sensitive endpoints, disabling xmlrpc via .htaccess rules if unused, and restricting author enumeration by returning generic responses. Finally, conduct regular security audits of wp-config.php permissions and cron job configurations to eliminate the exposure vectors this scanning activity is designed to exploit.
GB 
CH 
AU 
SE 
MX 
CA 
UA 
UZ 
RO 
BD