Notable Threat
IP 77.91.118.18 is a high-risk address associated with sustained hacking activity, having accumulated 1437 abuse reports within a three-month period at a threat level of 8 out of 10, indicating a persistent and dangerous threat actor targeting exposed services across the internet.
The IP resides within AS61436, operated by INTEX ltd in Russia, and was first reported in May 2026 with continued activity logged through July 2026, representing an active engagement window of approximately three months. Detection sources include 20 automated honeypot sensors that flagged the address for unauthorized access attempts, exploitation probes, and intrusion activity consistent with automated scanning and exploitation frameworks. The 94 percent confidence score and activity frequency rating of 8 out of 10 underscore that this is not isolated or accidental traffic but rather deliberate, repeated offensive operations against internet-facing systems. The volume of reports combined with the short detection window strongly suggests the address is part of an active campaign rather than a transient compromised host.
Hacking activity as documented in recent reports encompasses vulnerability probing, exploitation attempts, and unauthorized access enumeration against exposed services. This pattern poses a concrete risk to any internet-facing system with weak authentication, unpatched software, or misconfigured services, as automated exploitation toolkits routinely target these entry points at scale. Organizations with exposed SSH, Telnet, HTTP APIs, or database interfaces face elevated risk from such sources, as the address has demonstrated capability and intent to compromise perimeter defenses through persistent intrusion attempts.
Network defenders should consider blocking or rate-limiting traffic from this source at the firewall or intrusion prevention level, particularly for non-essential services. Implementing strong authentication mechanisms, enforcing principle-of-least-privilege access controls, and maintaining current patch management schedules significantly reduces exposure to the exploitation techniques associated with this threat actor. Deploying defensive tools such as fail2ban or similar dynamic blocking utilities can automatically mitigate repeated connection attempts. Continuous monitoring of authentication logs and implementing file integrity monitoring helps detect any successful intrusion attempts that may follow initial probing from addresses such as 77.91.118.18.
MX 
BG 
NL 
BD 
SC