Extreme Threat
IP 87.251.78.46 is a critical-risk address that has generated 497 abuse reports and is definitively linked to sustained web application attack activity targeting exposed online services.
Security monitoring systems detected this Russian Federation-registered IP, operating within autonomous system AS199785 under the administration of Cloud Hosting Solutions, Limited, as a source of malicious web application probes beginning in August 2025, with continued reporting activity persisting through December 2025. The 20 most recent confirmed reports all categorise the activity as web application attacks, detected exclusively through automated honeypot sensors. While the current activity frequency metric stands at zero, the exceptionally high volume of historical reports and maximum threat classification indicate a persistent, aggressive threat actor that may resume operations without warning. Cloud hosting infrastructure within AS199785 is frequently leveraged by threat actors for ephemeral attack campaigns, which explains the pattern of high-volume abuse followed by apparent dormancy observed here.
Web application attacks encompass a broad spectrum of exploitation techniques targeting vulnerabilities in internet-facing software, including injection flaws, cross-site scripting, file inclusion vulnerabilities, and other attack vectors documented in the OWASP Top 10. This IP has demonstrated active reconnaissance and probing of web-facing applications, systematically searching for entry points through misconfigured or outdated web components. Even a single successful exploitation against an unpatched application could result in data exfiltration, persistent backdoor access, lateral movement within a network, or complete server compromise, making this address dangerous regardless of its current inactivity status.
Defensive measures include deploying or hardening web application firewall rules to filter known malicious request signatures associated with web app attack patterns, ensuring all internet-facing applications are patched and updated, implementing strong authentication mechanisms with brute-force protection using tools such as fail2ban, and maintaining continuous monitoring for any resumption of scanning or attack activity originating from this address or adjacent infrastructure within the AS199785 autonomous system. Operators should also consider blocking traffic from this IP at the network perimeter as a precautionary measure given the critical threat level and extensive abuse history.
ME 
IT 
AE 
CZ 
GE 
UA 
GB 
CO 
CA 
VN