Notable Threat
IP 222.165.190.235, registered to Sri Lanka Telecom Internet (AS9329) in Sri Lanka, is a high-risk address with a threat level of 8/10 that has generated 592 total abuse reports, predominantly targeting WordPress authentication systems through coordinated brute-force and credential-stuffing campaigns.
With a confidence score of 100% across 20 distinct report sources—14 automated honeypot sensors and 6 community submissions—between April and May 2026, this IP demonstrates persistent and high-frequency malicious activity. The reported threat categories reveal a clear focus on web application attacks: 13 reports of WordPress login brute-force attempts, 13 general hacking probes, 11 brute-force detections, 4 distributed denial-of-service observations, single reports of WordPress plugin exploitation and user enumeration, and additional credential-stuffing activity targeting authentication endpoints. The volume and diversity of these simultaneous attack vectors indicate an automated infrastructure rather than opportunistic manual scanning.
The dominant activity pattern—brute-force and credential-stuffing attacks against WordPress login portals—poses a direct credential-compromise risk to any publicly exposed content management system. These systematic authentication attacks cycle through common credential combinations and previously leaked username-password pairs to gain unauthorized administrative access. Successful compromise of a WordPress installation can lead to website defacement, malware distribution, data exfiltration, or use of the compromised host as a staging point for further intrusions. The user-enumeration and plugin-probing sub-activities further suggest reconnaissance to identify vulnerable installation versions for targeted exploitation.
Site operators running WordPress or similar web applications should block this IP address at the network perimeter firewall or web application firewall level. Implementing multi-factor authentication on all administrative accounts substantially reduces the impact of successful credential guesses. Rate-limiting authentication endpoints and deploying automated threat-response tools such as fail2ban can detect and block repeated login failures in real time. Continuous monitoring of authentication logs for unusual POST requests to login paths and monitoring for WordPress REST API enumeration activity will help identify ongoing reconnaissance before a successful compromise occurs.
BG 
FR 
LU 
AU 
GB 
JP