High Risk
IP 141.98.11.181 is a high-risk address originating from Lithuania (AS209605, UAB Host Baltic) that has been linked to WordPress login brute-force attacks and related intrusion activity. With a threat level of 8/10 and 176 total abuse reports spanning from November 2025 to April 2026, this IP represents an ongoing credential-compromise threat to web-facing authentication endpoints, particularly WordPress installations.
The address has accumulated reports from 18 automated honeypot sensors and 2 community sources. The dominant threat pattern is WordPress login brute-force attempts, accounting for 18 of the recent reported incidents, alongside isolated brute-force, hacking, and DDoS activity. Automated sensors observed the WordPress escalation pattern with 50 violations and documented multiple failed authentication attempts within a 15-minute window, indicating a sustained and methodical approach to credential guessing. The geographic origin in Lithuania and routing through UAB Host Baltic provides network context for this persistent scanning behavior.
WordPress login brute-force attacks systematically test credential combinations against administrative login portals, exploiting weak or reused passwords. Successful compromise grants attackers administrative access, enabling website defacement, malware hosting, data exfiltration, or use of the compromised site as a pivot point for further attacks. The concurrent hacking and DDoS indicators suggest this address may participate in broader malicious campaigns beyond credential attacks alone, increasing the overall risk profile for any exposed service.
Site operators running WordPress should enforce strong password policies and implement multi-factor authentication on all administrative accounts. Deploying rate limiting or account lockout thresholds significantly raises the difficulty of successful brute-force attempts, and tools such as fail2ban can automatically detect and block repeated login failures. Keeping WordPress core, plugins, and themes updated eliminates known vulnerabilities that attackers might exploit alongside credential guessing. Organizations should monitor authentication logs for suspicious activity patterns matching this IP and block or challenge traffic from this address at the network perimeter.
GB 
UA 
RO 
BG 
KZ 
FR 
PS