Critical Threat
IP 85.11.167.3 is a critical-risk address originating from Bulgaria, operated by Sofcompany, that has been linked to 415 abuse reports across 20 distinct detection sources since November 2025, with the overwhelming majority of hostile activity targeting WordPress installations through coordinated reconnaissance and exploitation attempts.
The compiled evidence shows a concentrated threat profile where automated honeypot sensors and community reports converge on WordPress-specific attack vectors. Of the 415 total reports, the most prevalent categories include general hacking activity (11 reports), WordPress login brute-force attempts (8), user enumeration via author parameter probing (7), configuration file scanning (5), unauthorized cron execution (3), distributed denial-of-service activity (3), and web application reconnaissance (1). Detection logs document pattern sequences including repeated author parameter enumeration against WordPress endpoints, backup-related query parameter scanning, and configuration file exposure attempts consistent with targeted exploitation campaigns. The 20 reporting sources include 9 automated honeypot sensors and 11 community submissions, providing moderate confidence in the assessment despite the high volume of reports.
The dominant threat pattern reflects a systematic WordPress reconnaissance and compromise campaign rather than opportunistic scanning. Attackers leveraging author parameter enumeration attempt to discover valid usernames by iterating through sequential IDs, which then enables targeted brute-force attacks against known accounts. Configuration file scanning searches for exposed backups or sensitive files that may contain database credentials or encryption keys. Unauthorized cron execution attempts can abuse legitimate scheduled tasks to inject malicious payloads or extract data. Together, these techniques form a staged attack chain designed to progressively escalate privileges and maintain persistent access to WordPress-powered websites.
Site operators running WordPress should implement fail2ban or equivalent intrusion prevention rules configured to detect and block WordPress-specific attack patterns, including author enumeration and config file access attempts. Restricting XML-RPC and wp-cron access to authorized sources, enforcing strong authentication with two-factor authentication, and monitoring access logs for the query parameter patterns documented in honeypot events will significantly reduce exposure. Blocking or rate-limiting traffic from Bulgarian IP ranges at the network perimeter provides additional defense-in-depth where traffic patterns justify such measures.
RO 
GB 
TH 
HK 
CZ