IP Threat Report
169.150.242.5
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger medium hits: 6 | Medium-risk: admin panels, config files | +60 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Foreign referer seen | Referer from unrelated external domain | +10 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 169.150.242.5 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 169.150.242.5 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 443 | HTTPS | Low | HTTPS web server — encrypted web traffic |
| 444 | Unknown | Low | Service on port 444 |
| 3001 | Unknown | Low | Service on port 3001 |
| 3008 | Unknown | Low | Service on port 3008 |
| 3009 | Unknown | Low | Service on port 3009 |
| 3017 | Unknown | Low | Service on port 3017 |
| 3019 | Unknown | Low | Service on port 3019 |
| 3021 | Unknown | Low | Service on port 3021 |
| 3042 | Unknown | Low | Service on port 3042 |
| 3047 | Unknown | Low | Service on port 3047 |
| 3049 | Unknown | Low | Service on port 3049 |
| 3053 | Unknown | Low | Service on port 3053 |
| 3055 | Unknown | Low | Service on port 3055 |
| 3060 | Unknown | Low | Service on port 3060 |
| 3065 | Unknown | Low | Service on port 3065 |
| 3066 | Unknown | Low | Service on port 3066 |
| 3071 | Unknown | Low | Service on port 3071 |
| 3076 | Unknown | Low | Service on port 3076 |
| 3078 | Unknown | Low | Service on port 3078 |
| 3079 | Unknown | Low | Service on port 3079 |
| 3085 | Unknown | Low | Service on port 3085 |
| 3086 | Unknown | Low | Service on port 3086 |
| 3087 | Unknown | Low | Service on port 3087 |
| 3089 | Unknown | Low | Service on port 3089 |
| 3095 | Unknown | Low | Service on port 3095 |
| 4000 | Unknown | Low | Service on port 4000 |
| 4021 | Unknown | Low | Service on port 4021 |
| 4022 | Unknown | Low | Service on port 4022 |
| 4040 | Unknown | Low | Service on port 4040 |
| 4043 | Unknown | Low | Service on port 4043 |
| 4063 | Unknown | Low | Service on port 4063 |
| 4064 | Unknown | Low | Service on port 4064 |
| 4072 | Unknown | Low | Service on port 4072 |
| 4095 | Unknown | Low | Service on port 4095 |
| 4100 | Unknown | Low | Service on port 4100 |
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
169.150.242.5 has been assigned a threat score of 85/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.
The following attack categories were identified:
📊 Threat Analysis
Threat intelligence analysis has linked 169.150.242.5 to malicious activity originating from Zagreb, HR, operating on the network of DataCamp Limited. The address has been under observation since its initial detection. Over a period of 1 days, this IP generated 1 malicious requests, averaging approximately 1 requests per day. The address is classified as residential, meaning it likely belongs to an end-user ISP connection. Malicious activity from residential IPs typically indicates device compromise or botnet membership. The IP exhibits directory enumeration behavior, systematically requesting non-existent paths to discover hidden files and misconfigured resources. The score of 85/100 indicates a confirmed malicious actor. Network-level blocking is appropriate.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
🇭🇷 Top threats from HR
View all →Security Intelligence
💡 Command Injection Techniques
Command injection occurs when attackers insert operating system commands through application inputs. Successful exploitation grants direct server access, enabling data theft, malware installation, and lateral movement across networks.
💡 XML External Entity (XXE) Attacks
XXE vulnerabilities in XML parsers allow attackers to read local files, perform SSRF, and execute denial of service attacks. Many legacy applications and APIs remain vulnerable to XXE due to insecure default XML parser configurations.