Notable Threat
IP 195.178.110.199 is a high-risk address originating from Bulgaria (AS48090 / Techoff Srv Limited) that has generated 295 abuse reports since December 2025, with automated honeypot sensors flagging it 16 times alongside 4 community submissions. The IP demonstrates an 8/10 threat level driven predominantly by WordPress credential attacks, including 15 WP Login Brute Force incidents, 10 WP Admin Brute Force probes, and sustained reconnaissance activity targeting WordPress installations through plugin scanning, version enumeration, and configuration file access attempts.
The sustained activity frequency of 8/10 and the 85% confidence score indicate persistent, automated exploitation infrastructure rather than isolated scanning. Detection logs across multiple honeypot environments reveal systematic probing patterns: the address conducted 12 suspicious requests against CMS targets within a two-minute window, attempted repeated Drupal admin enumeration, and triggered multiple fail2ban recidive jail actions, confirming it is a multi-service attacker cycling through content management systems. The blend of credential brute-forcing, version fingerprinting, and config exposure attempts reflects a coordinated campaign to identify and compromise WordPress deployments at both the authentication and configuration layers.
WordPress brute-force and admin probing activity poses a concrete risk to any exposed wp-login.php or wp-admin endpoints, as successful authentication grants attackers administrative control over the site, enabling malware deployment, data exfiltration, or further network pivoting. The configuration exposure and version scanning phases indicate pre-exploitation reconnaissance, meaning defenders should treat these probes as precursors to more damaging intrusions if credentials are weak or unpatched vulnerabilities exist in plugins and themes.
Site operators running WordPress should enforce strong, unique passwords alongside two-factor authentication on all admin accounts and consider implementing fail2ban or equivalent rate-limiting rules that block repeated login failures against authentication endpoints. Restricting access to wp-admin and wp-login.php via IP allowlisting or VPN gateways reduces exposure to external brute-force attempts. Disabling XML-RPC if unused, hiding WordPress version headers, and deploying a Web Application Firewall signature set tuned to CMS exploitation patterns will further blunt the reconnaissance and attack vectors this IP has demonstrated.
RO 
IR 
ES 
EE 
FR