IP Threat Report
112.196.0.228
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger medium hits: 10 | Medium-risk: admin panels, config files | +60 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Foreign referer seen | Referer from unrelated external domain | +10 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 112.196.0.228 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 112.196.0.228 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 111 | Unknown | Low | Service on port 111 |
| 444 | Unknown | Low | Service on port 444 |
| 801 | Unknown | Low | Service on port 801 |
| 1080 | Unknown | Low | Service on port 1080 |
| 2083 | Unknown | Low | Service on port 2083 |
| 3132 | Unknown | Low | Service on port 3132 |
| 3136 | Unknown | Low | Service on port 3136 |
| 5004 | Unknown | Low | Service on port 5004 |
| 5007 | Unknown | Low | Service on port 5007 |
| 5010 | Unknown | Low | Service on port 5010 |
| 7777 | Unknown | Low | Service on port 7777 |
| 8001 | Unknown | Low | Service on port 8001 |
| 8011 | Unknown | Low | Service on port 8011 |
| 8021 | Unknown | Low | Service on port 8021 |
| 8055 | Unknown | Low | Service on port 8055 |
| 8056 | Unknown | Low | Service on port 8056 |
| 8060 | Unknown | Low | Service on port 8060 |
| 8080 | HTTP-Alt | Low | HTTP alternative port — often used for admin panels or proxies |
| 8112 | Unknown | Low | Service on port 8112 |
| 8121 | Unknown | Low | Service on port 8121 |
| 8182 | Unknown | Low | Service on port 8182 |
| 8185 | Unknown | Low | Service on port 8185 |
| 8291 | MikroTik | High | MikroTik Winbox — router management, targeted by VPNFilter malware |
| 8481 | Unknown | Low | Service on port 8481 |
| 8586 | Unknown | Low | Service on port 8586 |
| 8887 | Unknown | Low | Service on port 8887 |
| 8988 | Unknown | Low | Service on port 8988 |
| 8989 | Unknown | Low | Service on port 8989 |
| 9000 | Unknown | Low | Service on port 9000 |
| 9191 | Unknown | Low | Service on port 9191 |
| 9443 | Unknown | Low | Service on port 9443 |
| 9899 | Unknown | Low | Service on port 9899 |
| 9990 | Unknown | Low | Service on port 9990 |
| 9999 | Unknown | Low | Service on port 9999 |
| 33060 | Unknown | Low | Service on port 33060 |
⚠️ 1 high-risk port detected on 112.196.0.228. These services should not be publicly accessible without strict firewall rules.
| CVE ID | Link |
|---|---|
| CVE-2024-38473 | NVD → |
| CVE-2012-3526 | NVD → |
| CVE-2025-53020 | NVD → |
| CVE-2022-29404 | NVD → |
| CVE-2021-44224 | NVD → |
| CVE-2025-14178 | NVD → |
| CVE-2025-65082 | NVD → |
| CVE-2022-31813 | NVD → |
| CVE-2024-42516 | NVD → |
| CVE-2009-2299 | NVD → |
| CVE-2025-1735 | NVD → |
| CVE-2025-66200 | NVD → |
| CVE-2024-33661 | NVD → |
| CVE-2024-38474 | NVD → |
| CVE-2021-26690 | NVD → |
| CVE-2022-28614 | NVD → |
| CVE-2021-32785 | NVD → |
| CVE-2019-17567 | NVD → |
| CVE-2021-23017 | NVD → |
| CVE-2022-23943 | NVD → |
| CVE-2020-11993 | NVD → |
| CVE-2022-22721 | NVD → |
| CVE-2024-38472 | NVD → |
| CVE-2024-38477 | NVD → |
| CVE-2024-47252 | NVD → |
🔴 This host has 92 known CVEs associated with its exposed services. This volume strongly suggests severely outdated software. Review each CVE in the NVD database.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
112.196.0.228 has been assigned a threat score of 85/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.
The following attack categories were identified:
📊 Threat Analysis
112.196.0.228 is registered in Amritsar, India, operating on the network of Hfcl Infotel LTD. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. Over a period of 1 days, this IP generated 1 malicious requests, averaging approximately 1 requests per day. This residential IP is likely a compromised consumer device. Home routers and IoT equipment with default credentials are prime targets for botnet operators. The IP exhibits directory enumeration behavior, systematically requesting non-existent paths to discover hidden files and misconfigured resources. Our records show 107 malicious IPs originating from India, positioning it as a significant contributor to global threat activity. A threat score of 85/100 places this IP in the high-risk category. Blocking at the firewall level is recommended.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
🇮🇳 Top threats from India
49.248.192.204 (313)62.72.43.237 (305)4.188.251.0 (280)103.78.247.150 (280)40.80.90.214 (280)View all →🏢 Same network: AS17917
112.196.79.138 (93)49.156.113.114 (68)203.134.212.79 (68)180.214.138.3 (68)49.156.123.24 (60)View all →Security Intelligence
💡 Vulnerability Scanning Explained
Vulnerability scanning is the automated process of probing web applications for known weaknesses. Attackers use tools like Nuclei, Nikto, and ZAP to test thousands of hosts per hour, looking for exposed configuration files, outdated software, and default credentials.
💡 Patch Management Urgency
The window between vulnerability disclosure and exploitation continues to shrink. Critical CVEs are now exploited within hours of publication. Automated patch management, virtual patching through WAFs, and rapid deployment pipelines are essential for timely remediation.