Maximum Danger
IP address 4.197.162.185 is a critical-risk address operated within Microsoft's AS8075 infrastructure in Australia, exhibiting a threat level of 10 out of 10 with 206 total abuse reports and a perfect 100% confidence score, indicating this host is almost certainly engaged in systematic WordPress-targeted exploitation including brute-force authentication attacks, configuration file reconnaissance and unauthorized cron job execution.
The IP was first and last reported in January 2026 across both automated honeypot sensors and community sources, with a notably high activity frequency rating of 8 out of 10, suggesting sustained, persistent offensive operations rather than opportunistic scanning. Among the 206 reports filed, the dominant threat categories are general hacking activity (12 reports), WordPress login brute-force attempts (7 reports) and WordPress admin brute-force attacks (6 reports), complemented by configuration exposure probes (4 reports), cron abuse (1 report) and distributed denial-of-service activity (1 report). Automated honeypot detections and community reports collectively document an attacker systematically targeting WordPress installations, with evidence of configuration file scanning for sensitive paths including plugin directories, theme files and mu-plugins locations, as well as unauthorized WordPress cron execution originating from this address.
The concentration of WordPress-specific attack vectors points to an automated campaign aimed at compromising content management systems through credential guessing and filesystem reconnaissance. Brute-force attempts against login and admin interfaces can rapidly expose weak passwords, while configuration file scanning probes for exposed sensitive data such as database credentials or API keys commonly stored in accessible directories. Unauthorized cron execution abuse allows an attacker to trigger resource-intensive background tasks without authentication, potentially degrading target website performance or facilitating further exploitation chains. The simultaneous deployment of multiple attack techniques at high frequency indicates a sophisticated actor capable of adapting tactics to exploit vulnerable WordPress deployments at scale.
NL 
JP 
IE 
HK 
CA 
SE 
BG 
FR 
LU 
LK 
GB