Dashboard›🇮🇳 India›103.78.247.150
ABUSE.MOM
THREAT REPORT

IP Threat Report
103.78.247.150

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 06:03:59
First seen: 2026-02-17 17:25:05
Last seen: 2026-02-19 11:00:07
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 68.

UA_SUSDANGER_PATHREDIRECT_PROBEBURSTRATIO_404UA_CHANGEDMETHODREFERERIMPORT
01

Geolocation & Classification

IP Address
103.78.247.150
Type
Residential
Country
🇮🇳 India
City
Navi Mumbai
ISP
Web Werks India Pvt. Ltd.
Organization
WEBWERKS
Autonomous System
AS133296 Web Werks India Pvt. Ltd.
Hit Count
68
02

Detection Signatures

SignatureDescriptionPointsSeverity
UA suspicious (short/empty)Behavioral anomaly detected by automated analysis+15
Danger strong hits: 41High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 7Medium-risk: admin panels, config files+60
Probe pattern 302->404 same pathBehavioral anomaly detected by automated analysis+20
Burst: 59 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 59 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 10High-risk paths: shells, RCE vectors, exploits+100
Burst: 10 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 10 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 44High-risk paths: shells, RCE vectors, exploits+100
Burst: 65 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 65 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 40High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 9Medium-risk: admin panels, config files+60
Burst: 64 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 64 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 42High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 6Medium-risk: admin panels, config files+60
Burst: 48 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 48 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Burst: 8 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 83High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 12Medium-risk: admin panels, config files+60
Burst: 102 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 102 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 5Medium-risk: admin panels, config files+50
Burst: 26 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 26 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 16High-risk paths: shells, RCE vectors, exploits+100
Burst: 30 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 30 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 63 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 63 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 62High-risk paths: shells, RCE vectors, exploits+100
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst: 91 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 91 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 74High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 13Medium-risk: admin panels, config files+60
Burst: 60 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 60 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 4Medium-risk: admin panels, config files+40
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
Burst: 45 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 45 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 35High-risk paths: shells, RCE vectors, exploits+100
Burst: 51 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 51 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 3Medium-risk: admin panels, config files+30
Burst: 27 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 27 req / 10sAbnormally fast request rate — automated scanning+35
UA changed for same IPMultiple User-Agents — bot rotation technique+25
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Burst: 13 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 13 req / 10sAbnormally fast request rate — automated scanning+35
POST requests presentBehavioral anomaly detected by automated analysis+8
Danger strong hits: 25High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 1Medium-risk: admin panels, config files+10
Burst: 34 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 34 req / 10sAbnormally fast request rate — automated scanning+35
Foreign referer seenReferer from unrelated external domain+10
Danger strong hits: 30High-risk paths: shells, RCE vectors, exploits+100
Burst: 40 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 40 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 11Medium-risk: admin panels, config files+60
Burst: 90 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 90 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 66High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 10Medium-risk: admin panels, config files+60
Burst: 95 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 95 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 108High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 16Medium-risk: admin panels, config files+60
Burst: 104 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 104 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 65High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger strong hits: 36High-risk paths: shells, RCE vectors, exploits+100
Burst: 52 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 52 req / 10sAbnormally fast request rate — automated scanning+35
Imported from old blocklistBehavioral anomaly detected by automated analysis+0
Danger strong hits: 47High-risk paths: shells, RCE vectors, exploits+100
Burst: 66 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 66 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 12High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 2Medium-risk: admin panels, config files+20
Burst: 15 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 15 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 56High-risk paths: shells, RCE vectors, exploits+100
Burst: 73 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 73 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 12 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 12 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 24High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 32Medium-risk: admin panels, config files+60
Burst: 128 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 128 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 21Medium-risk: admin panels, config files+60
Burst: 98 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 98 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 11High-risk paths: shells, RCE vectors, exploits+100
Burst: 42 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 42 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 19High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 24Medium-risk: admin panels, config files+60
Burst: 93 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 93 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 15High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 28Medium-risk: admin panels, config files+60
Burst: 107 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 107 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 31Medium-risk: admin panels, config files+60
Burst: 120 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 120 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 13High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 17Medium-risk: admin panels, config files+60
Danger strong hits: 22High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 26Medium-risk: admin panels, config files+60
Burst: 115 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 115 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 68 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 68 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 16 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 16 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 67 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 67 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 5 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Burst: 9 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 9High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 7High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger strong hits: 5High-risk paths: shells, RCE vectors, exploits+100
Burst: 6 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 11 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 11 req / 10sAbnormally fast request rate — automated scanning+35
Σ = 7388
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-02-17 17:25:05
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
UA suspicious (short/empty) (+15), Danger strong hits: 41 (+100), Danger medium hits: 7 (+60)
2026-02-19 11:00:07
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Web Werks India Pvt. Ltd.
AS133296 · 🇮🇳 India
06

Recommendations

Actions taken & recommended

  • IP 103.78.247.150 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 User-Agent Anomaly Defense

IP 103.78.247.150 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

🔎 Directory Scan Defense

IP 103.78.247.150 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

🌊 Traffic Flood Defense

IP 103.78.247.150 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

08

Open Ports & Services

Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.

OPEN PORTS (5)
PortServiceRiskDescription
80HTTPLowHTTP web server — standard web traffic
443HTTPSLowHTTPS web server — encrypted web traffic
7443UnknownLowService on port 7443
8081UnknownLowService on port 8081
8082UnknownLowService on port 8082
KNOWN VULNERABILITIES (CVE) (37)
CVE IDLink
CVE-2024-38474NVD →
CVE-2013-4365NVD →
CVE-2024-38475NVD →
CVE-2025-59775NVD →
CVE-2011-2688NVD →
CVE-2025-55753NVD →
CVE-2013-0942NVD →
CVE-2007-4723NVD →
CVE-2024-24795NVD →
CVE-2024-36387NVD →
CVE-2024-27316NVD →
CVE-2013-0941NVD →
CVE-2012-3526NVD →
CVE-2025-58098NVD →
CVE-2023-38709NVD →
CVE-2024-38476NVD →
CVE-2024-42516NVD →
CVE-2025-49630NVD →
CVE-2025-66200NVD →
CVE-2024-40898NVD →
CVE-2011-1176NVD →
CVE-2024-39573NVD →
CVE-2025-53020NVD →
CVE-2025-49812NVD →
CVE-2012-4001NVD →
+12 more

🔴 Security scanning identified 37 vulnerability entries on this host. This volume strongly suggests severely outdated software. Consult NVD advisories for details.

DETECTED TECHNOLOGIES
apache:http_server:2.4.58canonical:ubuntu_linux
Hostnames: rec1.qkonnect.io
PTR: rec1.qkonnect.io

Data source: Shodan InternetDB. Scanned independently of abuse.mom.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

103.78.247.150 has been assigned a threat score of 280/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

IP address 103.78.247.150 has been traced to Navi Mumbai, India, operating on the network of Web Werks India Pvt. Ltd.. Our threat detection systems have flagged this address based on observed malicious behavior patterns. During its 1-day observation window, we recorded 68 hostile requests from this IP — roughly 68 per day on average. Operating from a residential network, this IP may represent a compromised home gateway or IoT device that has been drafted into a larger attack infrastructure. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. With 101 flagged addresses, India represents a significant presence in our threat database. With a threat score of 280/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.

This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.

11

Related Threats

🇮🇳 Top threats from India

49.248.192.204 (313)62.72.43.237 (305)4.188.251.0 (280)40.80.90.214 (280)52.172.248.2 (280)View all →

🏢 Same network: AS133296

View all →
12

Security Intelligence

💡 TLS Fingerprinting (JA3/JA4)

TLS fingerprinting creates unique identifiers based on how clients negotiate encrypted connections. The JA3 and JA4 methods generate hashes from TLS ClientHello parameters, enabling identification of specific tools and malware regardless of IP address changes.

💡 Threat Intelligence Sharing Frameworks

Standards like STIX/TAXII, MISP, and OpenIOC enable automated sharing of threat intelligence between organizations. Collective defense through shared indicators, tactics, and procedures strengthens the entire security community against common threats.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 06:03
Behave or get exposed