Significant Threat
IP 185.177.72.30, allocated to Bucklog SARL under ASN AS211590 in France, is a maximum-threat-level address with a significant abuse record. The IP has accumulated 175 reports from automated honeypot sensors and community sources between December 2025 and May 2026, with a threat confidence score of 88 percent. The dominant threat profile centers on sustained credential-guessing campaigns against WordPress installations — specifically WP Login Brute Force and WP Admin Brute Force activity — alongside broader Hacking probes and an Exploited Host designation suggesting this address may itself be running malicious tooling or have been compromised as part of an attack infrastructure.
Detection data reveals a concentrated pattern of automated abuse. Fail2ban logs document 20 violations each for Drupal admin probing and 50 violations for WordPress configuration file access attempts, indicating persistent reconnaissance against content management systems. Suricata sensors additionally flagged anomalous Redis protocol detection suggesting scanning or exploitation activity against cache database services. The 175 total reports distributed across 20 independent honeypot sensors demonstrates broad, coordinated detection rather than isolated incidents, with the "Exploited Host" categorization in recent reports indicating the IP itself has been flagged as potentially compromised or weaponized by threat actors.
Credential brute-force attacks against WordPress admin panels represent a concrete, high-severity threat to any exposed installation. Successful authentication grants attackers administrative control of the website, enabling content manipulation, malware distribution, data exfiltration, or use of the compromised site as a staging point for further intrusions. The accompanying Drupal and Redis reconnaissance suggests the operator is methodically probing multiple web-facing services for vulnerabilities, while the Exploited Host status indicates this IP may already be functioning within a botnet or attack chain — meaning blocking it serves both defensive and intelligence purposes.
Site operators with publicly accessible WordPress or Drupal instances should immediately block 185.177.72.30 at the firewall or web application firewall level. Enforcing strong, unique administrative passwords alongside two-factor authentication renders credential-guessing campaigns ineffective even if the address is not permanently blocked. Implementing fail2ban or equivalent rate-limiting rules that trigger temporary IP bans after repeated failed login attempts significantly raises the cost of automated attacks. Regular audit of access logs for requests matching the probing patterns described — particularly wp-config access attempts and admin interface probes — enables early detection of successful compromise attempts.
RU 
GB 
RO 
VN 
HK 
SG