Cautionary Risk
IP 64.89.161.198, registered to ISP Associates in the United States, is a medium-high risk address associated with 230 abuse reports and a confidence score of 96%. The dominant threat activity is general hacking probes, accounting for 18 of the most recent reports, alongside bad web bot behavior, WordPress configuration exposure attempts, unauthorized WP-Cron execution, and isolated DDoS and web application attack signatures. With an activity frequency rated 8 out of 10, this IP demonstrates persistent, automated scanning behavior directed at web infrastructure.
Detection data draws from 16 automated honeypot sensors and 4 community-based reports, all timestamped to February 2026. Abstracted attack-pattern logs reveal repeated automated scanner detections targeting NGINX servers, with specific focus on suspicious backup-related POST requests and unauthorized WP-Cron execution attempts. The IP also generated multiple attack connection events and web application probe activities consistent with vulnerability scanning toolchains. The concentration of honeypot hits across multiple sensor types indicates this is not opportunistic noise but deliberate, systematic reconnaissance against exposed web services.
The hacking category encompasses intrusion attempts, vulnerability exploitation, and unauthorized access probes—behaviors confirmed by the observed scanner signatures and POST requests targeting backup files and cronjob endpoints. For site operators running WordPress, unauthorized cron execution can facilitate privilege escalation, data exfiltration, or secondary payload delivery. When combined with WP Config Exposure attempts and generic web application probes, this IP profile suggests an actor preparing for or conducting automated compromise campaigns against misconfigured or unpatched web servers rather than random scanning.
Operators should block or rate-limit this IP at the firewall or load balancer level given the sustained activity and diverse attack vector profile. Enforcing strict access controls on wp-cron.php, renaming or restricting access to sensitive backup file paths, and implementing fail2ban or equivalent intrusion prevention rules can disrupt the observed automation patterns. Web application firewalls with bot management capabilities provide an additional layer of defense against the bad web bot activity and scanner signatures associated with this address.
GB 
AE 
BE