Substantial Risk
IP 45.84.107.17 is a high-risk address operated by QuxLabs AB (AS214503) in Sweden that has generated 440 abuse reports over approximately eight months, with a threat level of 8/10. The dominant activity pattern involves active intrusion attempts and reconnaissance operations targeting exposed network infrastructure. Detection sources include 19 automated honeypot sensors and one community report, indicating sustained automated scanning and exploitation attempts rather than opportunistic activity.
Analysis of the 440 reports reveals a multifaceted threat profile dominated by hacking activity (15 confirmed instances), port scanning (4 instances), and exploited-host behavior (3 instances), alongside SSH brute-force and web application probes. The attack-pattern evidence shows systematic reconnaissance against CiscoASA devices, probes for vulnerable SMBv1 protocols commonly associated with ransomware vectors, and confirmed SSH brute-force attempts targeting authentication systems. Suricata alerts specifically flagged unsafe SMBv1 usage and active SSH sessions on non-standard ports, while honeypot sensors recorded direct attack connections and web application probes. The eight-month reporting window from September 2025 through May 2026 and moderate activity frequency of 3/10 indicate persistent rather than burst-oriented malicious operations.
The concentration of hacking and port-scanning activity suggests this address is being used for systematic network reconnaissance and exploitation preparation. Port scans against firewall appliances like CiscoASA often precede targeted exploitation of unpatched vulnerabilities or misconfigured security devices. The SMBv1 protocol probes align with known exploitation frameworks that target legacy network file-sharing protocols, while SSH brute-force attempts pose direct credential-compromise risks to exposed authentication interfaces. The combination of reconnaissance and exploitation activity indicates a capability-oriented actor rather than casual scanning.
Network defenders should block or aggressively rate-limit connections from this address at the perimeter firewall and implement fail2ban or similar authentication-hardening tools to mitigate brute-force attempts. Exposed services should be reviewed for unnecessary SMBv1 usage and patched against known vulnerabilities. Organizations with CiscoASA devices in their DMZ should verify current firmware and enforce strict access-control lists limiting management interfaces to trusted subnets. Ongoing monitoring for scanning patterns originating from this IP range will help identify any shifts in targeting behavior.
MC 
UA 
GB