Date: June 20, 2026 | Duration: 11:52 AM – 12:03 PM | Total Data: 12.13 MB --- 1. Attack Summary · Target: /wp-login.php · Method: HTTP POST · Status: 409 Conflict (100% of requests) · Unique attackers: 2 IP addresses --- 2. Attacking IPs IP Network Known Abuse 91.92.40.97 AS199760, Bulgaria Subnet flagged; no public blacklist presence at time of analysis 104.238.222.26 AS23470, ReliableSite.Net LLC, USA 1,756 reports; 417 sources; 100% confidence; confirmed brute-force activity (May 2026) --- 3. Attack Characteristics · Frequency: 1–2 second intervals, automated · User-Agent Rotation: 30+ unique strings across Windows/macOS/Linux, Chrome/Firefox/Safari variants · Coordination: Interleaved requests from both IPs targeting the same endpoint with identical request structures --- 4. HTTP 409 Response Analysis · All 1,000+ requests returned HTTP 409 with 83 bytes · Significance: Not a default WordPress response. Indicates an active security layer (WAF or security plugin) intercepting and blocking requests before authentication logic executes. · Conclusion: No login attempts reached the WordPress validation process. No successful compromise occurred. --- 5. Traffic Composition · 100% malicious traffic · 0% legitimate visitor traffic during the 11-minute window