Significant Threat
IP 91.92.243.251 is a moderate-to-high risk address associated with WordPress-focused authentication attacks, including brute-force attempts, credential stuffing, and unauthorized resource exploitation targeting exposed WordPress installations. With 497 total reports from community sources across February and March 2026, this IP demonstrates a persistent, automated threat profile focused on compromising WordPress-powered websites. The activity aligns with the dominant threat categories reported, making this an address that warrants blocking or strict monitoring on any internet-facing infrastructure.
Community-sourced threat intelligence documents 497 incident reports across a two-month window, with 20 distinct community sources contributing observations. The reported threat categories reveal a clear pattern: 20 brute-force incidents, 18 WordPress login brute-force attempts, 11 distributed denial-of-service indicators, 8 unauthorized WordPress cron execution events, 6 general hacking probes, and 6 resource exhaustion incidents. Automated honeypot sensors flagged this address repeatedly for WordPress force attempts, credential stuffing sequences, and unauthorized cron triggering, with server resource monitoring detecting elevated memory consumption reaching 86MB and extended query times exceeding two seconds per request. Despite the substantial report volume, the low 15% confidence score and zero activity frequency rating suggest this activity, while noisy, has not yet achieved wide corroboration across diverse detection networks. The IP originates from Railnet LLC operating AS214943 in the United States.
The dominant attack pattern centres on WordPress authentication infrastructure, where systematic credential guessing attempts to gain administrative access to websites. Unauthorized cron execution compounds this threat by allowing attackers to trigger background WordPress processes without legitimate authentication, potentially deploying malicious payloads or harvesting data. The observed resource exhaustion—high memory allocation and extended database query times—indicates that the targeted WordPress instances experienced measurable performance degradation during these attacks. These combined techniques can enable complete site compromise, malware deployment, data exfiltration, or conversion of the hosting server into an attack pivot.
BG 
BE