IP Threat Report
143.198.217.151
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Directory Scan | Behavioral anomaly detected by automated analysis | +0 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Recommendations
Actions taken & recommended
- IP 143.198.217.151 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 143.198.217.0/24
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
⚙️ Defensive Recommendations
Block 143.198.217.151 at the network perimeter. Implement defense-in-depth combining IP blocking with application-layer protections.
Neighbors in 143.198.217.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
143.198.217.151 has been assigned a threat score of 95/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.
📊 Threat Analysis
143.198.217.151 is registered in Singapore, Singapore, operating on the network of DigitalOcean, LLC. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. The address has been active for 17 days in our monitoring system, producing 940 flagged requests at a rate of ~55.3/day. With 102 flagged addresses, Singapore represents a significant presence in our threat database. At 95/100, this is an extremely high-risk address. All traffic should be considered hostile.
Related Threats
🇸🇬 Top threats from Singapore
85.203.23.12 (340)103.167.150.231 (340)62.146.238.136 (340)85.203.23.31 (330)192.166.246.30 (325)View all →Security Intelligence
💡 Ransomware-as-a-Service Economy
The RaaS model allows technically unskilled criminals to deploy sophisticated ransomware through affiliate programs. Operators provide the malware, infrastructure, and negotiation services, taking a percentage of ransom payments from their affiliates.
💡 Server-Side Template Injection
SSTI occurs when user input is embedded in server-side templates without sanitization. Successful exploitation often leads to remote code execution, as template engines typically have access to powerful server-side functionality.