Report for IP: 107.189.14.87

This IP was blocked attempting to log into a WordPress site's wp-login.php — either from a disallowed country or after exceeding the allowed number of failed login attempts. Automated credential-stuffing and brute-force tools account for the overwhelming majority of this traffic; legitimate users rarely trigger a hard IP block on login alone.

• FireHOL level2 — FireHOL level2 lists addresses seen attacking in the last 48 hours across many sensors. It is large and volatile: addresses enter and leave quickly, so on its own this is weaker, recent-activity evidence.
• This site (WordPress attackers, 90 days) — This site's own data: an IP that attacked WordPress sites and was reported here within the last 90 days. Independent of the third-party lists above.

Several independent community lists agree on this address.

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

This IP generated over 20 HTTP 4xx errors in 60 seconds using a User-Agent identified as a bad bot (scraper, headless browser, or attack proxy). The high error rate indicates automated probing for vulnerabilities while trying to appear as generic traffic. Legitimate services respect robots.txt and do not flood servers with errors.