High Risk
IP address 192.176.172.166, registered to Kepler Technologies AB in Sweden under ASN AS212220, presents a high-risk threat profile with a threat level of 8/10 and 248 total abuse reports from automated honeypot sensors and community contributors. The dominant attack vectors are WordPress login brute-force campaigns and general hacking activity, with additional brute-force and distributed denial-of-service attempts recorded over a five-month active period from February to June 2026.
The 248 reports collected against this address demonstrate sustained, high-frequency malicious behaviour with an activity frequency rating of 8/10. Fourteen automated honeypot sensors and six community sources independently confirmed the hostile activity, yielding a 100% confidence score. Fail2ban monitoring logs reveal the address as a recidive offender responsible for 50 WordPress escalation violations and five multi-jail recidive violations, indicating systematic, repeated attempts to compromise web authentication systems. Credential stuffing operations targeting common administrative login paths were observed, along with brute-force attempts against generic web endpoints.
The concentration of WordPress login brute-force attacks and credential stuffing activity poses a concrete risk to any publicly accessible content management system or authentication portal. Automated brute-force tools systematically cycle through credential combinations, increasing the likelihood of compromising weak or reused passwords. The additional DDoS capability suggests this infrastructure may participate in coordinated attack campaigns, amplifying its threat potential beyond individual site compromise.
Network operators should implement strict inbound traffic filtering, and administrators managing publicly accessible services should enforce strong password policies alongside multi-factor authentication. Deploying or strengthening fail2ban rules or equivalent intrusion prevention tools with aggressive retry lockouts and bans will disrupt repeated authentication attempts. Rate limiting on login endpoints and continuous monitoring of authentication logs for patterns consistent with credential stuffing further reduce exposure to this address and similar threats.
BG 
FR 
LU 
LK 
AU 
GB 
JP