IP Threat Report
147.90.18.125
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| Burst 11/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 6/2s | Abnormally fast request rate — automated scanning | +35 | |
| Danger medium hits: 11 | Medium-risk: admin panels, config files | +60 | |
| Danger strong hits: 10 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Foreign referer | Referer from unrelated external domain | +10 | |
| UA bot: Go-http-client | Known bot/crawler User-Agent detected | +40 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Recommendations
Actions taken & recommended
- IP 147.90.18.125 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 147.90.18.0/24
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 147.90.18.125 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
🌊 Traffic Flood Defense
IP 147.90.18.125 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.
🤖 Bot Detection
Address UA spoofing from 147.90.18.125: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.
Neighbors in 147.90.18.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
147.90.18.125 has been assigned a threat score of 305/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 147.90.18.125, located in Yerevan, AM, operating on the network of Private Customer, has been classified as malicious by our automated threat scoring engine. During its 1-day observation window, we recorded 74 hostile requests from this IP — roughly 74 per day on average. The address is classified as residential, meaning it likely belongs to an end-user ISP connection. Malicious activity from residential IPs typically indicates device compromise or botnet membership. The combination of 3 distinct attack vectors indicates a sophisticated, multi-pronged threat actor deploying automated tools that probe multiple attack surfaces simultaneously. Our records show 40 malicious IPs originating from AM, positioning it as a notable contributor to global threat activity. A score of 305/100 places this address in the top tier of severity. Block and investigate any historical connections.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
Security Intelligence
💡 DDoS Mitigation Approaches
Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.
💡 Credential Stuffing at Scale
Credential stuffing uses stolen username-password pairs from data breaches to attempt logins across many websites. Since users frequently reuse passwords, these automated attacks achieve success rates of 0.1-2%, which translates to thousands of compromised accounts from millions of attempts.