IP Threat Report
103.194.89.51
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger strong hits: 1 | High-risk paths: shells, RCE vectors, exploits | +25 | |
| Danger medium hits: 1 | Medium-risk: admin panels, config files | +10 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| POST requests present | Behavioral anomaly detected by automated analysis | +8 | |
| Danger strong hits: 2 | High-risk paths: shells, RCE vectors, exploits | +50 | |
| Danger medium hits: 2 | Medium-risk: admin panels, config files | +20 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 103.194.89.51 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Path Enumeration Protection
Block scanning from 103.194.89.51: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 311 | Unknown | Low | Service on port 311 |
| 443 | HTTPS | Low | HTTPS web server — encrypted web traffic |
| 444 | Unknown | Low | Service on port 444 |
| 465 | Unknown | Low | Service on port 465 |
| 636 | Unknown | Low | Service on port 636 |
| 1337 | Unknown | Low | Service on port 1337 |
| 1926 | Unknown | Low | Service on port 1926 |
| 2083 | Unknown | Low | Service on port 2083 |
| 2087 | Unknown | Low | Service on port 2087 |
| 2376 | Unknown | Low | Service on port 2376 |
| 3001 | Unknown | Low | Service on port 3001 |
| 3269 | Unknown | Low | Service on port 3269 |
| 3780 | Unknown | Low | Service on port 3780 |
| 3790 | Unknown | Low | Service on port 3790 |
| 4064 | Unknown | Low | Service on port 4064 |
| 4433 | Unknown | Low | Service on port 4433 |
| 4434 | Unknown | Low | Service on port 4434 |
| 4443 | Unknown | Low | Service on port 4443 |
| 4444 | Unknown | Low | Service on port 4444 |
| 4911 | Unknown | Low | Service on port 4911 |
| 5001 | Unknown | Low | Service on port 5001 |
| 5006 | Unknown | Low | Service on port 5006 |
| 5986 | Unknown | Low | Service on port 5986 |
| 6443 | Unknown | Low | Service on port 6443 |
| 6697 | Unknown | Low | Service on port 6697 |
| 7001 | Unknown | Low | Service on port 7001 |
| 7071 | Unknown | Low | Service on port 7071 |
| 7415 | Unknown | Low | Service on port 7415 |
| 7434 | Unknown | Low | Service on port 7434 |
| 7443 | Unknown | Low | Service on port 7443 |
| 7548 | Unknown | Low | Service on port 7548 |
| 8009 | Unknown | Low | Service on port 8009 |
| 8083 | Unknown | Low | Service on port 8083 |
| 8085 | Unknown | Low | Service on port 8085 |
| 8089 | Unknown | Low | Service on port 8089 |
| 8139 | Unknown | Low | Service on port 8139 |
| 8140 | Unknown | Low | Service on port 8140 |
| 8181 | Unknown | Low | Service on port 8181 |
| 8443 | HTTPS-Alt | Low | Service on port 8443 |
| 8834 | Unknown | Low | Service on port 8834 |
| 8880 | Unknown | Low | Service on port 8880 |
| 8883 | Unknown | Low | Service on port 8883 |
| 8889 | Unknown | Low | Service on port 8889 |
| 9000 | Unknown | Low | Service on port 9000 |
| 9001 | Unknown | Low | Service on port 9001 |
| 9002 | Unknown | Low | Service on port 9002 |
| 9091 | Unknown | Low | Service on port 9091 |
| 9095 | Unknown | Low | Service on port 9095 |
| 9398 | Unknown | Low | Service on port 9398 |
| 9443 | Unknown | Low | Service on port 9443 |
| 9898 | Unknown | Low | Service on port 9898 |
| 9943 | Unknown | Low | Service on port 9943 |
| 10000 | Unknown | Low | Service on port 10000 |
| 10134 | Unknown | Low | Service on port 10134 |
| 10250 | Unknown | Low | Service on port 10250 |
| 10443 | Unknown | Low | Service on port 10443 |
| 10909 | Unknown | Low | Service on port 10909 |
| 10911 | Unknown | Low | Service on port 10911 |
| 16993 | Unknown | Low | Service on port 16993 |
| 31337 | Unknown | Low | Service on port 31337 |
| 47990 | Unknown | Low | Service on port 47990 |
| 51235 | Unknown | Low | Service on port 51235 |
| 55443 | Unknown | Low | Service on port 55443 |
| 55553 | Unknown | Low | Service on port 55553 |
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
103.194.89.51 has been assigned a threat score of 93/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.
The following attack categories were identified:
📊 Threat Analysis
IP address 103.194.89.51 has been traced to Noida, India, operating on the network of Elyzium Technologies Pvt. Ltd.. Our threat detection systems have flagged this address based on observed malicious behavior patterns. Our sensors captured 2 malicious requests from this address across a 6-day span, reflecting a sustained attack cadence of ~0.3 requests per day. The address is classified as residential, meaning it likely belongs to an end-user ISP connection. Malicious activity from residential IPs typically indicates device compromise or botnet membership. The IP exhibits directory enumeration behavior, systematically requesting non-existent paths to discover hidden files and misconfigured resources. Our records show 102 malicious IPs originating from India, positioning it as a significant contributor to global threat activity. A score of 93/100 places this address in the top tier of severity. Block and investigate any historical connections.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
Security Intelligence
💡 Directory Traversal Attacks
Path traversal attacks attempt to access files outside the intended directory by manipulating file path references. Attackers use sequences like ../ to reach sensitive system files such as /etc/passwd or application configuration files.
💡 File Upload Vulnerabilities
Insecure file upload functionality allows attackers to upload web shells, malware, or scripts that execute on the server. Proper validation must check file content, not just extensions, and uploaded files should be stored outside the web root.