Maximum Danger
IP address 91.224.92.28 is a critical-risk address associated with 631 documented abuse reports and sustained brute-force activity targeting web authentication interfaces, with the vast majority of recent detections tied to general hacking probes and WordPress login credential attacks. The IP carries a maximum threat score of 10 out of 10, reflecting the volume and severity of intrusion attempts detected by honeypot sensors across a four-month observation window from August to November 2025. Its network originates from AS209605, operated by Lithuanian company UAB Host Baltic, while routing geographically through the United Kingdom.
Community and automated honeypot sensors filed a combined 631 reports for this address, with 20 distinct honeypot instances contributing detections across the reporting period. The threat landscape for this IP breaks down to 19 distinct hacking-related intrusion attempts and one dedicated WordPress login brute-force event, indicating a dual-focus threat profile that combines broad vulnerability probing with targeted credential-stuffing campaigns against content management systems. The honeypot data further confirms that fail2ban escalation rules were triggered in response to the wordpress attack pattern, validating that the detected activity was aggressive enough to exceed automated defensive thresholds. The sustained report volume over four months demonstrates persistent, repeated targeting rather than isolated scanning.
Hacking activity of this nature represents automated exploitation attempts against exposed services, probing for known vulnerabilities, misconfigurations or weak authentication mechanisms that could yield unauthorized system access. The WordPress login brute-force component specifically targets the administrative login portals of websites running the popular content management system, attempting credential combinations at scale to compromise admin accounts. When successful, such attacks can lead to complete website defacement, data exfiltration, malware distribution or use of the compromised server as a pivot point for further network intrusion. The fail2ban trigger observed in the honeypot event log confirms that login attempt rates were sufficiently aggressive to activate defensive response mechanisms.
LT 
RO 
BG 
TH 
HK 
CZ