Critical Threat
IP address 45.84.107.55, allocated to QuxLabs AB in Sweden under autonomous system AS214503, presents a critical threat to exposed network infrastructure, scoring a maximum 10 out of 10 on assessed danger with a 69 percent confidence rating derived from 391 total abuse reports submitted over approximately nine months between September 2025 and May 2026. This address has been flagged across 15 automated honeypot sensors and 5 community-driven report sources, indicating sustained, high-volume malicious activity that crosses multiple threat categories. The dominant activity involves general hacking intrusion attempts, confirmed brute-force authentication attacks, reconnaissance port scans targeting Cisco ASA appliances, and a subset of specifically WordPress-oriented exploitation probes including configuration exposure, core vulnerabilities and backdoor installation attempts. The sheer breadth and volume of concurrent attack vectors make this IP a particularly versatile and dangerous actor in any environment where it is observed.
The pattern of activity detected against 45.84.107.55 reveals a multi-stage attack methodology consistent with automated compromise toolkits. Suricata-based detections specifically captured active SSH sessions on non-standard ports alongside the use of potentially unsafe SMBv1 protocols, suggesting the IP is not merely probing but actively exploiting or attempting to persist on targeted systems. Cisco ASA port scanning — a well-documented reconnaissance technique used to map perimeter defenses — appeared repeatedly alongside malware and exploit activity signatures, indicating the operator is systematically enumerating and exploiting vulnerable edge devices. The combination of brute-force SSH attempts, WordPress-specific exploitation attempts and SMBv1 abuse points to a threat actor leveraging a broad exploit toolkit rather than targeting a single service or vulnerability class. While the reporting window spans roughly nine months, the activity frequency rating of 5 out of 10 suggests the IP does not hammer targets continuously but sustains an ongoing presence with periodic bursts of activity.
FR 
HK 
TW 
PE 
GB