Я другой аноним, у меня вот что:whois -h whois.ripe.net 91.210.104.245
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '91.210.104.0 - 91.210.107.255'
% Abuse contact for '91.210.104.0 - 91.210.107.255' is 'abuse@hostkey.ru'
inetnum: 91.210.104.0 - 91.210.107.255
netname: RU-SERVER-V-ARENDY
country: RU
org: ORG-LVA15-RIPE
admin-c: AS36383-RIPE
tech-c: AS36383-RIPE
status: ASSIGNED PI
mnt-by: HOSTKEY-RU-MNT
mnt-by: RIPE-NCC-END-MNT
created: 2019-06-25T10:02:14Z
last-modified: 2019-06-25T12:23:20Z
source: RIPE
organisation: ORG-LVA15-RIPE
org-name: LLC "Server v arendy"
org-type: LIR
address: Barabannyi line , 4/4
address: 107023
address: Moscow
address: RUSSIAN FEDERATION
phone: +7(495)369-97-96
descr: www.hostkey.ru
admin-c: AS36383-RIPE
tech-c: AS36383-RIPE
abuse-c: AR34585-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: HOSTKEY-RU-MNT
mnt-by: RIPE-NCC-HM-MNT
mnt-by: HOSTKEY-RU-MNT
created: 2015-12-08T08:26:31Z
last-modified: 2019-10-02T08:26:58Z
source: RIPE # Filtered
person: RIPE Team
address: Barabannyi line , 4/4
address: 107023
address: Moscow
address: RUSSIAN FEDERATION
phone: +7(495)369-97-96
org: ORG-LVA15-RIPE
nic-hdl: AS36383-RIPE
mnt-by: HOSTKEY-RU-MNT
created: 2015-12-08T08:26:30Z
last-modified: 2019-07-01T08:05:35Z
source: RIPE # Filtered
% Information related to '91.210.104.0/24AS49335'
route: 91.210.104.0/24
origin: AS49335
mnt-by: HOSTKEY-RU-MNT
created: 2012-03-11T04:46:36Z
last-modified: 2019-06-28T13:42:13Z
source: RIPE
% This query was served by the RIPE Database Query Service version 1.95.1 (ANGUS)
Так что сервер таки на хостинге в РФ (что, строго говоря, ничего не говорит о местонахождении преступников).