Significant Threat
IP 172.104.241.98, allocated to Akamai Connected Cloud in Germany, presents a critical threat level of 10/10 based on 740 total abuse reports from both automated honeypot sensors and community contributors over approximately six months. The address is linked predominantly to hacking activity, with secondary focus on WordPress credential stuffing campaigns targeting login and administrative interfaces. Despite a low current activity frequency rating, the sheer volume of historical reports and diversity of attack patterns—including Redis exploitation and malware activity—underscore a persistent, methodical threat actor.
The reports originate from a balanced mix of 7 automated honeypot sensors and 13 community sources, providing a confidence score of 65 percent in the attribution. The timeline spans from August 2025 through February 2026, indicating sustained engagement rather than opportunistic scanning. Attack pattern telemetry reveals Drupal-related brute-force mitigation triggers, generic honeypot event sequences, and explicit references to Redis attack vectors, suggesting the actor possesses flexibility to adapt exploitation techniques across multiple exposed services.
WordPress brute-force activity targets authentication endpoints to harvest administrative access, enabling content defacement, data exfiltration, or further lateral movement within compromised networks. The hacking classification encompasses broader intrusion attempts, vulnerability probing, and unauthorized access vectors that can compromise unpatched or misconfigured systems. Redis attacks indicate interest in cache and database layer targeting, potentially enabling command injection or data manipulation. The combined focus on web application authentication and backend services reflects an actor seeking footholds across multiple entry points.
Operators should block or rate-limit this IP at the network edge, enforce strong authentication on administrative interfaces, and deploy defensive tools such as fail2ban to automatically ban repeated login failures. Web application firewalls should filter WordPress login paths, and Redis instances should be network-isolated with authentication enabled. Continuous monitoring of honeypot telemetry and community feeds will help identify renewed activity patterns should this address resume operations.
US 
AU 
GB 
KR 
HK