Threat LevelHIGH65/1004 rule types across 3 attack categories
20 incidents · 4 rule types · active attacker + blocklisted · persistent 9-day campaign · last seen 26d ago
| PTR | srv-141-98-11-18.serveroffer.net |
| Org / ASN | AS209605 UAB Host Baltic |
| Country | 🇱🇹 Lithuania |
| City | Vilnius, Vilnius |
| Timezone | Europe/Vilnius |
Attack Analysis
IDS: Blocklist — Spamhaus DROP
This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.
WordPress XML-RPC Abuse
This IP targeted xmlrpc.php, a legacy WordPress endpoint that has been abused for brute-force authentication attacks, credential stuffing, and DDoS amplification. Any direct access to xmlrpc.php is an attack or reconnaissance attempt; modern WordPress sites should disable it entirely.
WordPress: Brute Force Attack
This IP was blocked attempting to log into a WordPress site's wp-login.php — either from a disallowed country or after exceeding the allowed number of failed login attempts. Automated credential-stuffing and brute-force tools account for the overwhelming majority of this traffic; legitimate users rarely trigger a hard IP block on login alone.
local blocklist
Reports (20)
| Date | Severity | Description |
|---|---|---|
| 11 Oct 2026 - 04:23 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 10 Oct 2026 - 08:16 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 9 Oct 2026 - 22:26 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 9 Oct 2026 - 19:18 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 9 Oct 2026 - 11:33 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 8 Oct 2026 - 19:26 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 8 Oct 2026 - 14:02 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 8 Oct 2026 - 12:37 | high | IDS: Blocklist — Spamhaus DROP listed IP |
| 8 Oct 2026 - 12:36 | low | local blocklist |
| 8 Oct 2026 - 12:36 | medium | WordPress Login Brute Force Attempt |
| 8 Oct 2026 - 11:46 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 6 Oct 2026 - 12:52 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 6 Oct 2026 - 05:50 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 5 Oct 2026 - 03:45 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 4 Oct 2026 - 05:56 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 4 Oct 2026 - 03:43 | high | WordPress: xmlrpc.php accessed |
| 4 Oct 2026 - 03:41 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 2 Oct 2026 - 07:28 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
| 2 Oct 2026 - 02:53 | high | WordPress: xmlrpc.php accessed |
| 2 Oct 2026 - 02:41 | high | IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 27 |
EagleEye Intelligence