High Risk
IP 178.128.211.158 is a high-risk address assessed at threat level 7/10 that has generated 210 community abuse reports primarily documenting WordPress authentication attacks, with the IP originating from DigitalOcean's AS14061 network infrastructure in Singapore.
Automated honeypot sensors and community reporting platforms logged this activity during December 2025, with 20 distinct community sources contributing reports. The dominant threat vectors identified across these reports include WP Login Brute Force attempts and general Brute-Force attacks accounting for 24 combined reports, followed by WP User Enumeration attempts comprising 8 reports, WP REST API Abuse at 4 reports, and additional Hacking category activity at 4 reports. Despite the substantial report volume, the IP carries a low confidence score of 28% and an activity frequency rating of 0/10, suggesting intermittent rather than sustained aggressive behavior. The IP routes through DigitalOcean's cloud infrastructure in Singapore, a common platform for both legitimate hosting and for actors rotating through cloud resources to conduct authentication attacks against web applications.
WordPress brute-force attacks systematically target the wp-login.php endpoint, cycling through credential combinations to gain unauthorized administrative access. WordPress user enumeration exploits the author parameter in REST API queries or archive pages to harvest valid usernames before launching targeted credential attacks. The WP REST API Abuse category indicates attempts to interact with WordPress API endpoints in ways designed to extract site data or probe for vulnerable configurations. Together these attack patterns represent a coordinated reconnaissance and intrusion campaign against WordPress installations, with successful compromise potentially enabling website defacement, malware distribution, data exfiltration, or use of the compromised site as a pivot point for further network intrusion.
Site operators running WordPress should immediately review authentication logs for connections originating from this IP and implement defensive controls such as restricting wp-login.php and XML-RPC access to trusted IP ranges, enforcing strong password policies, and deploying multi-factor authentication for administrative accounts. Implementing rate-limiting rules and account lockout policies using tools like fail2ban can effectively mitigate brute-force attempts. Disabling WordPress REST API endpoints for unauthenticated users and preventing author enumeration by returning a 404 response for invalid author queries reduces the effectiveness of reconnaissance activity. Regular monitoring of access logs for this IP address and correlated activity across shared cloud ranges remains advisable given the confirmed hostile intent.
NL 
GB 
CA 
BD