Notable Threat
IP 141.98.11.44, hosted in Lithuania under UAB Host Baltic (AS209605), presents a high-risk threat profile with a threat-level score of 8/10, primarily linked to WordPress login brute-force attacks detected across 20 automated honeypot sensors. The address has accumulated 209 total abuse reports, with the dominant recent activity being 19 WordPress brute-force incidents alongside isolated SMTP spam reports. The IP was first reported in August 2025, with the most recent detection in April 2026, indicating persistent malicious behavior over an extended observation window.
Analysis of detected attack patterns reveals that automated systems logged 50 violations related to WordPress escalation attempts, matching the wp-login brute-force signature associated with credential-stuffing campaigns. Although the overall activity frequency is rated low, the consistent volume of abuse reports across multiple independent honeypot sensors establishes a credible threat pattern with a 61% confidence score. The concentration of attacks targeting WordPress administrative interfaces suggests the infrastructure is specifically provisioned or compromised for Web-application credential compromise rather than opportunistic scanning.
WordPress login brute-force attacks represent a concrete authentication-bypass threat where adversaries systematically attempt common username and password combinations to gain unauthorized CMS access. Successful compromise grants attackers website administrative control, enabling content defacement, malware injection, data exfiltration, or pivoting to adjacent network resources. The SMTP spam activity detected on the same infrastructure indicates potential dual-purpose hosting, either as a bulletproof hosting environment for multiple threat actors or as a single actor operating diverse attack vectors from the same endpoint.
Site operators exposing WordPress administrative interfaces should implement immediate defensive controls: enforce strong passphrase policies and limit authentication attempts using tools such as fail2ban or equivalent rate-limiting solutions, restrict wp-admin access to trusted IP ranges via network-level ACLs, and deploy two-factor authentication for all administrative accounts. Additionally, implementing SPF, DKIM, and DMARC email authentication protocols helps mitigate abuse of associated SMTP infrastructure. Continuous monitoring of authentication logs for unusual geographic access patterns and automated scanning for new brute-force signatures remains essential given this IP's documented threat history.
GB 
UA 
MX 
BE 
OM 
RO