Extreme Threat
IP 93.123.109.152 is a critical-risk address operating from Bulgaria (AS48090, Techoff Srv Limited) that has generated 203 abuse reports since September 2025, with a 10/10 threat level indicating maximum severity. The IP's dominant activity profile consists of general hacking intrusion attempts alongside WordPress credential-guessing attacks, suggesting a systematic and automated assault campaign against web-facing authentication interfaces.
The detection footprint spans 20 automated honeypot sensors and reveals consistent malicious activity through December 2025. Among the catalogued incidents, 16 reports document general hacking activity including exploitation attempts and unauthorized access probes, while 8 additional reports specifically target WordPress login and administrative portals via brute-force techniques. Fail2ban sensors flagged drupal-enhanced rule triggers against this address, confirming automated detection of credential-stuffing or vulnerability-probing behavior. Despite a 69% confidence score, the sheer volume of reports from multiple independent sources firmly establishes this IP as an active threat actor within the Bulgarian network segment operated by Techoff Srv Limited.
Hacking category activity encompasses the exploitation of known vulnerabilities, intrusion attempts, and reconnaissance probes designed to gain unauthorized system access. When combined with WordPress brute-force targeting, this IP poses a dual-vector threat to organisations running CMS platforms or unpatched web applications. Successful exploitation could yield full administrative control over compromised sites, data exfiltration, malware deployment, or lateral movement into connected infrastructure. The automated nature of these attacks means exposed services face continuous bombardment until effective mitigations are deployed.
Site operators should immediately block or heavily rate-limit authentication endpoints accessible from this IP address. Implementing multi-factor authentication on all administrative interfaces significantly reduces the impact of credential-guessing attempts. Deploying or enhancing fail2ban rules tuned to detect brute-force patterns—particularly those matching drupal and WordPress login signatures—will automate blocking of repeat offenders. Additionally, restricting access to login pages via IP allowlisting or geo-blocking Bulgarian traffic if business operations do not require it provides an effective defensive layer against this specific threat actor.
FR 
HK 
TW 
PE 
GB