IP Threat Report
110.249.201.243
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| UA bot: spider | Known bot/crawler User-Agent detected | +40 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 110.249.201.243 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 110.249.201.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🤖 User-Agent Anomaly Defense
IP 110.249.201.243 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.
🔎 Path Enumeration Protection
Block scanning from 110.249.201.243: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
Neighbors in 110.249.201.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
110.249.201.243 has been assigned a threat score of 65/100 (High). At this threat level, the IP is considered high risk. Firewall rules should be updated to deny traffic from this source.
The following attack categories were identified:
📊 Threat Analysis
Threat intelligence analysis has linked 110.249.201.243 to malicious activity originating from Chengde, China, operating on the network of China Unicom Hebei Province Network. The address has been under observation since its initial detection. The address has been active for 86 days in our monitoring system, producing 10 flagged requests at a rate of ~0.1/day. The address is classified as residential, meaning it likely belongs to an end-user ISP connection. Malicious activity from residential IPs typically indicates device compromise or botnet membership. The dual attack vectors of User-Agent Anomaly combined with Path Enumeration indicate a coordinated assault rather than opportunistic scanning. China currently accounts for 234 blocked IPs in our database, making it a significant source of malicious traffic. The score of 65/100 warrants active monitoring and rate-limiting. Full blocking is advisable for sensitive systems.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
Security Intelligence
💡 TLS Fingerprinting (JA3/JA4)
TLS fingerprinting creates unique identifiers based on how clients negotiate encrypted connections. The JA3 and JA4 methods generate hashes from TLS ClientHello parameters, enabling identification of specific tools and malware regardless of IP address changes.
💡 Server-Side Request Forgery (SSRF)
SSRF attacks trick servers into making requests to internal resources that should not be publicly accessible. This can expose cloud metadata endpoints, internal APIs, and private network services, potentially leading to full infrastructure compromise.