IP Threat Report
177.222.113.202
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| Danger strong hits: 1 | High-risk paths: shells, RCE vectors, exploits | +25 | |
| Foreign referer | Referer from unrelated external domain | +10 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
We have detected 8 malicious IPs from this autonomous system.
Recommendations
Actions taken & recommended
- IP 177.222.113.202 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 177.222.113.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Path Enumeration Protection
Block scanning from 177.222.113.202: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
Neighbors in 177.222.113.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
177.222.113.202 has been assigned a threat score of 60/100 (High). The IP is rated as a high-level threat. Network administrators should implement blocking rules and monitor for any connections from this address.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 177.222.113.202, located in La Paz, BO, operating on the network of Telefónica Celular de Bolivia S.A., has been classified as malicious by our automated threat scoring engine. The address has been active for 1 days in our monitoring system, producing 4 flagged requests at a rate of ~4/day. The address belongs to a mobile carrier network. The sustained pattern of malicious requests indicates either a compromised device or deliberate abuse. Active path scanning has been detected — this IP probes for hundreds of common file and directory names. Our records show 29 malicious IPs originating from BO, positioning it as a notable contributor to global threat activity. The score of 60/100 warrants active monitoring and rate-limiting. Full blocking is advisable for sensitive systems.
Related Threats
Security Intelligence
💡 Cross-Site Scripting (XSS) Attacks
XSS attacks inject malicious scripts into web pages viewed by other users. Reflected XSS uses crafted URLs, while stored XSS persists in databases. Both types can steal session cookies, redirect users, or deface websites.
💡 Open Source Intelligence Methods
OSINT techniques leverage publicly available information for security research. DNS records, WHOIS data, certificate transparency logs, social media, and code repositories all provide valuable intelligence for threat analysis without requiring special access or tools.