Date: June 20, 2026 | Duration: 11:52 AM – 12:03 PM | Total Data: 12.13 MB
---
1. Attack Summary
· Target: /wp-login.php
· Method: HTTP POST
· Status: 409 Conflict (100% of requests)
· Unique attackers: 2 IP addresses
---
2. Attacking IPs
IP Network Known Abuse
91.92.40.97 AS199760, Bulgaria Subnet flagged; no public blacklist presence at time of analysis
104.238.222.26 AS23470, ReliableSite.Net LLC, USA 1,756 reports; 417 sources; 100% confidence; confirmed brute-force activity (May 2026)
---
3. Attack Characteristics
· Frequency: 1–2 second intervals, automated
· User-Agent Rotation: 30+ unique strings across Windows/macOS/Linux, Chrome/Firefox/Safari variants
· Coordination: Interleaved requests from both IPs targeting the same endpoint with identical request structures
---
4. HTTP 409 Response Analysis
· All 1,000+ requests returned HTTP 409 with 83 bytes
· Significance: Not a default WordPress response. Indicates an active security layer (WAF or security plugin) intercepting and blocking requests before authentication logic executes.
· Conclusion: No login attempts reached the WordPress validation process. No successful compromise occurred.
---
5. Traffic Composition
· 100% malicious traffic
· 0% legitimate visitor traffic during the 11-minute window ← Back to Fiveo1