Significant Threat
IP 185.177.72.23 is a maximum-threat-level address operated by Bucklog SARL in France that has accumulated 167 abuse reports across automated honeypot sensors since January 2026, with the last confirmed activity in May 2026. Despite a relatively low activity frequency rating of 2 out of 10, the concentration of credential-attack patterns targeting WordPress installations and Content Management System infrastructure, combined with detected exploitation attempts against Drupal and Redis services, establishes this IP as a persistent, high-risk actor in the threat landscape.
The abuse report corpus for 185.177.72.23 reflects a focused, multi-vector assault profile. WordPress-focused brute-force activity dominates the dataset, comprising 18 reported attempts against WordPress login endpoints and 10 against administrative interfaces, alongside 1 reported web application attack and 1 classified as general hacking activity. Fail2ban sensor logs corroborate this pattern, documenting 20 violations tied to Drupal admin probing and 50 violations attributed to WordPress escalation via wp-config access attempts. A Suricata alert further documented application-layer protocol anomalies consistent with Redis service reconnaissance. The detection footprint spans 20 distinct automated honeypot sensors, generating a confidence score of 80 percent for the aggregated threat assessment. The temporal spread across five months indicates persistent, repeated targeting rather than opportunistic scanning bursts.
WordPress brute-force attacks, as demonstrated by this IP address, exploit weak or reused credentials on one of the world's most widely deployed Content Management Systems. Successful authentication grants adversaries administrative control of the web property, enabling malware injection, data exfiltration, or pivot attacks against downstream users. The simultaneous targeting of Drupal administrative interfaces and Redis protocol detection probes reveals a broader scanning methodology that probes multiple service layers for accessible entry points. An exploited host classification in the reports suggests this IP has already been associated with at least one confirmed system compromise, elevating its risk profile beyond mere scanning to active exploitation capability. The low activity frequency combined with maximum threat classification indicates that each interaction carries substantial potential impact, likely against hardened or high-value targets.
RO