IP Threat Report
185.139.138.188
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Burst 24/10s | Abnormally fast request rate — automated scanning | +35 | |
| Burst 7/2s | Abnormally fast request rate — automated scanning | +35 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 185.139.138.188 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🌊 Traffic Flood Defense
IP 185.139.138.188 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
185.139.138.188 has been assigned a threat score of 70/100 (High). At this threat level, the IP is considered high risk. Firewall rules should be updated to deny traffic from this source.
The following attack categories were identified:
📊 Threat Analysis
185.139.138.188 is registered in Tashkent, UZ, operating on the network of "Uzbektelekom" Joint Stock Company. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. The address has been active for 2 days in our monitoring system, producing 102 flagged requests at a rate of ~51/day. The address belongs to a mobile carrier network. The sustained pattern of malicious requests indicates either a compromised device or deliberate abuse. The IP is engaged in request flooding, sending traffic at rates designed to exhaust server capacity. UZ currently accounts for 71 blocked IPs in our database, making it a notable source of malicious traffic. The score of 70/100 indicates a confirmed malicious actor. Network-level blocking is appropriate.
Related Threats
🇺🇿 Top threats from UZ
90.156.195.162 (195)213.230.92.111 (110)213.230.87.96 (103)213.230.87.66 (103)92.253.195.204 (103)View all →🏢 Same network: AS201767
View all →Security Intelligence
💡 DDoS Mitigation Approaches
Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.
💡 Autonomous System Analysis
Analyzing attack patterns at the AS (Autonomous System) level reveals which networks harbor the most malicious activity. Some ASes have abuse rates orders of magnitude higher than average, indicating lax enforcement of acceptable use policies.