Significant Threat
IP address 91.227.37.60, registered to Eurofiber France SAS and geolocated in France, presents a high-risk threat profile with a calculated threat level of 8 out of 10 based on 200 total abuse reports and a confidence score of 100%. The address demonstrates persistent WordPress reconnaissance and authentication attack behavior, making it a confirmed threat vector requiring immediate defensive action from operators running web-facing content management systems.
Detection data shows 91.227.37.60 generating activity across 12 automated honeypot sensors and 8 independent community reports, with both initial and most recent observations occurring between April and May 2026. The dominant threat categories include general hacking attempts (16 reports), brute-force authentication attacks (15 reports), and WordPress-specific login brute-forcing (11 reports), supplemented by distributed denial-of-service activity, user enumeration probes, and plugin vulnerability exploitation attempts. This concentration of WordPress-targeted activity indicates systematic reconnaissance against a specific platform rather than generic port scanning.
The attack patterns observed against honeypot infrastructure reveal coordinated exploitation of WordPress REST API endpoints for user enumeration, credential stuffing against authentication portals, and brute-force attempts using common administrative credential pairs. Each technique individually poses moderate risk, but their combined deployment suggests an automated credential compromise campaign capable of silently compromising WordPress installations that lack multi-factor authentication or strong password policies. Successful exploitation could grant persistent backdoor access to compromised websites for content manipulation, malware distribution, or further lateral movement.
Site operators should immediately block or rate-limit connections from 91.227.37.60 at the network perimeter, enforce multi-factor authentication on all administrative accounts, rename default administrative paths, and implement fail2ban or equivalent intrusion prevention rules targeting repeated authentication failures and suspicious API requests. Regular security audits, prompt WordPress core and plugin updates, and web application firewall rules blocking enumeration patterns provide additional protective depth against similar reconnaissance activity.
BG 
LU 
LK 
AU 
GB 
JP