Notable Threat
IP 212.89.15.132, registered in Spain and operated by R Cable y Telecable Telecomunicaciones, S.A.U. under ASN AS12946, is a high-risk address with a threat level of 8/10 and 99% confidence based on 237 total abuse reports. The dominant activity involves automated attacks against WordPress installations, including XML-RPC brute force, login brute force, and system file probing, alongside credential stuffing attempts using common administrative credentials and reconnaissance port scanning. The concentration of reports within April 2026 and the one-in-ten activity frequency signal persistent, targeted exploitation rather than opportunistic scanning.
The detection data draws from 18 automated honeypot sensors and 2 community reports spanning the same reporting period, providing substantial corroboration. The IP exhibits a clear attack pattern: reconnaissance via port scanning and WordPress system file probes, followed by credential stuffing and brute force attempts against administrative endpoints and XML-RPC interfaces. Observed behaviors include the use of very old browser user agents, which is a known evasion technique, and systematic probing of WordPress paths. With 60 combined reports in the two most prevalent categories alone, the volume and consistency of malicious activity are significant.
The WordPress XML-RPC and login brute force activity poses a concrete risk to exposed sites because XML-RPC allows attackers to conduct authentication attempts with minimal request overhead, bypassing rate limits that might otherwise throttle direct login attempts. When combined with credential stuffing using common credential pairs, this approach dramatically increases the likelihood of unauthorized administrative access. Port scanning further indicates that the IP is performing infrastructure reconnaissance to identify additional attack surfaces. Organizations running WordPress deployments face the highest exposure, particularly if they have not disabled XML-RPC, enforced strong unique passwords, or implemented two-factor authentication on admin accounts.
Site operators should take the following defensive steps: disable or restrict access to XML-RPC if not required, or use a web application firewall to limit XML-RPC authentication calls; implement rate limiting and account lockout policies to mitigate brute force attempts; enforce strong, unique passwords and enable two-factor authentication for all administrative accounts; and monitor logs for the user agent patterns and scanning behavior associated with this IP. Blocking or challenging traffic from this address at the firewall level is also advisable given the persistent nature of the observed activity.
VN 
NP 
KR 
FR 
ET