High Risk
IP address 82.196.25.136, hosted in France under ASN AS30781 and operated by Free Pro SAS, is assessed as a high-risk threat with a threat level of 8/10 based on 228 total reports and 100% confidence. This address is primarily associated with brute-force authentication attacks and systematic WordPress vulnerability probing, activity that has been consistently detected between April 2026 and June 2026 across both automated honeypot sensors and community-based reporting sources.
The volume and consistency of reports are significant: 228 abuse reports from 20 distinct sources (11 automated honeypot detections and 9 community submissions) within a compressed three-month window yields an activity frequency rating of 8/10. The reported threat categories reveal a focused, multi-vector approach, with 31 combined brute-force related reports (including standard brute-force attempts and WordPress-specific login brute-force), 16 general hacking probes, and smaller volumes of DDoS activity, WordPress plugin exploitation attempts, and user enumeration scans. Attack patterns indicate this actor systematically targets common administrative authentication endpoints and WordPress installations, attempting default and commonly used credentials against web-facing services.
The dominant threat pattern observed here combines credential-based attacks with vulnerability reconnaissance. Brute-force attempts against authentication portals represent a direct pathway to unauthorized system access when successful, while WordPress-specific probes such as REST API enumeration and plugin exploit scanning suggest the actor is probing for known vulnerabilities in content management system deployments. The presence of DDoS activity further indicates this address may participate in broader attack infrastructure. For organizations running web-facing services, particularly WordPress installations, these patterns represent concrete exploitation risk that could result in website compromise, data exfiltration, or resource exhaustion.
Defensive measures should include immediate blocking or rate-limiting of this IP at the network perimeter, implementation of account lockout policies and multi-factor authentication on all administrative interfaces, and deployment of intrusion detection rules that flag rapid authentication attempts against web endpoints. Web application firewalls should be configured to detect and block WordPress-specific reconnaissance patterns, and operators should ensure all WordPress core, plugin, and theme installations are kept current with security patches.
BG 
LU 
LK 
AU 
GB 
JP