Significant Threat
IP address 45.198.224.5 is a high-risk address that security monitoring systems have flagged 1,572 times since May 2026, with automated honeypot sensors and community reports identifying it primarily as a source of hacking activity and aggressive automated web crawling. Operated by Vpsvault.host Ltd under autonomous system AS215925 in the United States, this IP exhibits an activity frequency rating of 8 out of 10 and a confidence score of 96 percent, indicating the threat assessment is highly reliable. The volume and consistency of reports across a three-month window make this address a clear candidate for proactive blocking by administrators with exposed services.
The overwhelming majority of detections—1,567 out of 1,572 reports—classified the activity as general hacking, with the remainder split between bad web bot behavior, WordPress-focused fake SEO crawling, port scanning and web application attacks. Automated honeypot sensors accounted for 17 of the recent threat reports while community sources contributed 3, suggesting this IP has been observed actively probing diverse targets over an extended period. The attack pattern notes reveal that the source is using the Go-http-client automated HTTP client to conduct authentication endpoint probing at paths such as /login, indicating a systematic scanning campaign rather than opportunistic noise.
Authentication endpoint probes represent a concrete real-world risk because they are a prerequisite stage for credential stuffing and brute-force attacks against login portals. When combined with the observed path scanning and web application attack signatures, this activity suggests the operator is systematically mapping exposed services for potential exploitation, potentially as part of an automated vulnerability assessment or credential compromise campaign. The use of a standard automated HTTP client like Go-http-client allows the traffic to blend with legitimate API calls, making naive rate limiting less effective without additional fingerprinting.
Administrators should consider implementing automated blocking and rate-limiting measures such as fail2ban or equivalent tools configured to trigger on repeated authentication probe patterns from this IP and similar addresses. Web application firewalls or bot management solutions can help detect and mitigate the Go-http-client User-Agent signature while allowing legitimate traffic. Keeping authentication endpoints behind layered protections such as multi-factor authentication, IP allowlisting where feasible, and monitoring for unusual login attempt volumes provides defense-in-depth against the type of systematic probing this IP represents.
SE 
GB 
AE 
LT 
BE