High Risk
IP 91.224.92.35 is a high-risk address classified at threat level 8/10, linked to sustained WordPress login brute-force attacks against exposed web applications. The IP has accumulated 162 total abuse reports, with automated honeypot sensors contributing the majority of recent detections over a seven-month active period spanning October 2025 through May 2026. Community reports corroborate the hostile activity, confirming that this address is engaged in systematic credential-guessing campaigns rather than incidental scanning.
Network analysis places 91.224.92.35 within AS209605, operated by UAB Host Baltic, a Lithuanian network provider, though routing metadata associates the address with United Kingdom infrastructure. The 86% confidence score reflects strong evidentiary support across detection sources. Activity frequency of 7/10 and the 20 recent reports in the latest period indicate this threat actor maintains persistent, automated scanning operations. Detection logs document multiple fail2ban wordpress-escalation events with 50 to 51 violations each, alongside direct identification of WordPress installations responding to authentication probes within short time windows.
WordPress login brute-force attacks systematically target the wp-login.php endpoint, cycling through username and password combinations to compromise administrative accounts. Successful access grants attackers full control over the content management system, enabling data exfiltration, malware hosting, or lateral movement into broader network infrastructure. The volume and persistence of recent reports confirm this IP participates in high-confidence, high-frequency credential stuffing campaigns that pose concrete risk to any exposed WordPress deployment regardless of organizational size.
Site operators should immediately block or restrict access from 91.224.92.35 at the network perimeter using firewall rules or intrusion prevention systems. Deploying fail2ban with a wordpress-escalation jail provides automated detection and temporary blocking of the observed attack patterns. Enforcing multi-factor authentication on all administrative accounts eliminates the primary attack surface even if credentials are compromised. Rate limiting on authentication endpoints and monitoring for repeated failed-login patterns from this source address will further reduce exposure to similar credential-guessing campaigns.
LT 
RO 
PL