IP Threat Report
157.230.40.199
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| UA changed for same IP | Multiple User-Agents — bot rotation technique | +25 | |
| Danger strong hits: 4 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Danger medium hits: 3 | Medium-risk: admin panels, config files | +30 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| Probe pattern 302->404 same path | Behavioral anomaly detected by automated analysis | +20 | |
| Foreign referer seen | Referer from unrelated external domain | +10 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 157.230.40.199 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 157.230.40.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🤖 Bot Detection
Address UA spoofing from 157.230.40.199: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.
🔎 Path Enumeration Protection
Block scanning from 157.230.40.199: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
Neighbors in 157.230.40.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 22 | SSH | Low | Secure Shell — common brute force target for remote access |
| 23 | Telnet | Critical | Telnet — unencrypted remote access, extremely dangerous if exposed |
| 26 | Unknown | Low | Service on port 26 |
| 66 | Unknown | Low | Service on port 66 |
| 79 | Unknown | Low | Service on port 79 |
| 80 | HTTP | Low | HTTP web server — standard web traffic |
| 88 | Unknown | Low | Service on port 88 |
| 104 | Unknown | Low | Service on port 104 |
| 110 | POP3 | Low | Service on port 110 |
| 119 | Unknown | Low | Service on port 119 |
| 443 | HTTPS | Low | HTTPS web server — encrypted web traffic |
| 888 | Unknown | Low | Service on port 888 |
| 1443 | Unknown | Low | Service on port 1443 |
| 2000 | Unknown | Low | Service on port 2000 |
| 2001 | Unknown | Low | Service on port 2001 |
| 2022 | Unknown | Low | Service on port 2022 |
| 2030 | Unknown | Low | Service on port 2030 |
| 2443 | Unknown | Low | Service on port 2443 |
| 3102 | Unknown | Low | Service on port 3102 |
| 4000 | Unknown | Low | Service on port 4000 |
| 4433 | Unknown | Low | Service on port 4433 |
| 4530 | Unknown | Low | Service on port 4530 |
| 4840 | Unknown | Low | Service on port 4840 |
| 5010 | Unknown | Low | Service on port 5010 |
| 5240 | Unknown | Low | Service on port 5240 |
| 5242 | Unknown | Low | Service on port 5242 |
| 5542 | Unknown | Low | Service on port 5542 |
| 6633 | Unknown | Low | Service on port 6633 |
| 7006 | Unknown | Low | Service on port 7006 |
| 8008 | Unknown | Low | Service on port 8008 |
| 8080 | HTTP-Alt | Low | HTTP alternative port — often used for admin panels or proxies |
| 8440 | Unknown | Low | Service on port 8440 |
| 8441 | Unknown | Low | Service on port 8441 |
| 8800 | Unknown | Low | Service on port 8800 |
| 8908 | Unknown | Low | Service on port 8908 |
| 9017 | Unknown | Low | Service on port 9017 |
| 9042 | Unknown | Low | Service on port 9042 |
| 9214 | Unknown | Low | Service on port 9214 |
| 9242 | Unknown | Low | Service on port 9242 |
| 9999 | Unknown | Low | Service on port 9999 |
| 20107 | Unknown | Low | Service on port 20107 |
| 45000 | Unknown | Low | Service on port 45000 |
| 45001 | Unknown | Low | Service on port 45001 |
⚠️ 1 high-risk port detected on 157.230.40.199. Telnet (23) transmits credentials in plaintext — likely a compromised IoT device. These services should not be publicly accessible without strict firewall rules.
| CVE ID | Link |
|---|---|
| CVE-2009-3720 | NVD → |
| CVE-2009-2940 | NVD → |
| CVE-2025-13836 | NVD → |
| CVE-2021-32052 | NVD → |
| CVE-2024-6232 | NVD → |
| CVE-2024-7592 | NVD → |
| CVE-2024-9287 | NVD → |
| CVE-2023-36632 | NVD → |
| CVE-2023-27043 | NVD → |
| CVE-2025-12084 | NVD → |
| CVE-2020-29396 | NVD → |
| CVE-2025-13837 | NVD → |
| CVE-2023-30861 | NVD → |
| CVE-2025-12781 | NVD → |
🔴 Security scanning identified 14 vulnerability entries on this host. This volume strongly suggests severely outdated software. Consult NVD advisories for details.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
157.230.40.199 has been assigned a threat score of 210/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.
The following attack categories were identified:
📊 Threat Analysis
IP address 157.230.40.199 has been traced to Singapore, Singapore, operating on the network of DigitalOcean, LLC. Our threat detection systems have flagged this address based on observed malicious behavior patterns. The address has been active for 1 days in our monitoring system, producing 2 flagged requests at a rate of ~2/day. The IP is classified as hosting/datacenter infrastructure, commonly associated with rented servers used for automated attack campaigns, botnet command-and-control, or vulnerability scanning at scale. Two attack patterns were identified (User-Agent Anomaly and Path Enumeration), suggesting a semi-automated campaign that targets multiple vulnerabilities. Our records show 141 malicious IPs originating from Singapore, positioning it as a significant contributor to global threat activity. At 210/100, this is an extremely high-risk address. All traffic should be considered hostile.
This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.
Related Threats
Security Intelligence
💡 HTTP Header Analysis for Threat Detection
Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.
💡 HTTP/2 and HTTP/3 Security Implications
Modern HTTP protocols introduce new attack surfaces including stream multiplexing abuse, header compression attacks (HPACK bombing), and rapid reset attacks. Security tools must evolve to handle these protocol-specific threats effectively.