Significant Threat
IP 45.91.64.7 is a high-risk address associated with aggressive hacking activity, generating 548 abuse reports over five months with a threat level of 8/10 and a confidence score of 87%.
The IP originates from Russia and is routed through AS214664, operated by JSC Buduschee. Automated honeypot sensors logged 548 reports across 20 distinct detection sources, with activity confirmed from January 2026 through May 2026, yielding an activity frequency rating of 8/10. The dominant threat category is general hacking activity, accounting for the vast majority of recent reports, supplemented by web application attacks, IoT-targeted probes, and exploited host detections. Observed attack patterns include SSH session establishment attempts on non-standard ports, malformed TCP stream packets triggering Suricata alerts, and reconnaissance activity targeting web applications and IoT/ICS infrastructure. This concentrated, multi-vector activity over an extended timeframe signals a persistent threat actor rather than opportunistic scanning.
The hacking activity linked to IP 45.91.64.7 represents unauthorized access attempts, vulnerability exploitation, and intrusion behaviors that directly threaten system integrity. SSH session probes indicate credential brute-forcing activity, while malformed packet signatures suggest automated exploitation toolkits probing for misconfigurations or vulnerabilities in exposed services. Web application attack vectors exploit weaknesses such as injection flaws and authentication bypass, and IoT targeting reflects systematic scanning for poorly secured connected devices. The combination of techniques increases the IP reputation risk for any exposed network segment, as successful compromise could provide entry for data exfiltration, lateral movement, or recruitment into botnet operations.
Site operators should block IP 45.91.64.7 at the network perimeter or firewall level immediately. Implement fail2ban or equivalent rate-limiting tools to detect and throttle repeated SSH connection attempts. Enforce key-based SSH authentication and disable password-based login entirely on exposed services. Maintain updated intrusion detection signatures and review honeypot telemetry logs regularly to identify emerging attack patterns before they reach production systems.
GB 
IR 
UA