Suspicious popup denies user login

Hey there,

Yesterday I realized something strange, when I tried to login on my blog spiegelwelten.ch. Whenever I try to login (=click on “Anmelden”) a popup prompt appears, telling me that authentification is required. The page has never done this before. I’ve seen this yesterday for the first time.
The popup appears as this: http://spiegelwelten.ch/pics/login-prompt.jpg (btw. it’s German and says: “Authentification required. http://spiegelwelten.ch requires a user name and a password. Prompt from website: ‘Automatic Protection – Username: protected Password: wordpress | visit http://www.webhostingstatus.com for more info’.”

First of all. This popup appears on my other blogs as well (ravenport.ch and schwyzrocks.ch), so I suppose it doesn’t have anything to do with plugins, because the plugin configuration is different on any site. If you want, I can give you the list of plugins I use.

I struggled with this popup. I tried to fill in my admin username – which isn’t “admin” btw. – and password but that didn’t work. I tried a lot, including resetting pw through ftp and mysql. I could change it but the popup was still there. I even deleted the whole page on the webspace and restored an old backup to see, if the popup appeared there as well. The backup was from December 12 and the popup didn’t appear. So, I restored my newest backup and the popup appeared again.
Then I realized, when I fill in “protected” as username and “wordpress” as password in the prompt, I’m being forwarded to the login page and am able to login normally.
However, now that I’ve read about the brute force attacks on wordpress, I’m a bit worried.
I mean, I could work with the old backup from december 12 and restore the missing content manually (which wouldn’t be that much of a disaster), but that probably wouldn’t resolve the problem, would it?

So, is this popup something wordpress implemented in the last update? Or have I become a victim of an attack? Does this popup snoop my admin password? And what the heck is “webhostingstatus.com”?

I’m not sure, what to do and am really worried. Help is greatly appreciated. Thanks!

Greets
vegainthemirror