IP Threat Report
194.61.58.197
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger strong hits: 1 | High-risk paths: shells, RCE vectors, exploits | +25 | |
| Danger medium hits: 1 | Medium-risk: admin panels, config files | +10 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| POST requests present | Behavioral anomaly detected by automated analysis | +8 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 194.61.58.197 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 194.61.58.197 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 123 | Unknown | Low | Service on port 123 |
| 161 | Unknown | Low | Service on port 161 |
| CVE ID | Link |
|---|---|
| CVE-2015-7977 | NVD → |
| CVE-2016-4956 | NVD → |
| CVE-2015-7702 | NVD → |
| CVE-2015-1798 | NVD → |
| CVE-2016-4954 | NVD → |
| CVE-2016-4953 | NVD → |
| CVE-2014-9296 | NVD → |
| CVE-2009-0159 | NVD → |
| CVE-2015-7852 | NVD → |
| CVE-2015-7704 | NVD → |
| CVE-2015-7691 | NVD → |
| CVE-2015-7853 | NVD → |
| CVE-2017-6458 | NVD → |
| CVE-2015-7851 | NVD → |
| CVE-2015-7848 | NVD → |
| CVE-2013-5211 | NVD → |
| CVE-2009-0021 | NVD → |
| CVE-2015-1799 | NVD → |
| CVE-2014-9295 | NVD → |
| CVE-2015-7850 | NVD → |
| CVE-2020-13817 | NVD → |
| CVE-2015-7705 | NVD → |
| CVE-2015-7701 | NVD → |
| CVE-2016-2518 | NVD → |
| CVE-2015-7973 | NVD → |
🔴 This host has 40 known CVEs associated with its exposed services. This volume strongly suggests severely outdated software. Review each CVE in the NVD database.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
194.61.58.197 has been assigned a threat score of 68/100 (High). At this threat level, the IP is considered high risk. Firewall rules should be updated to deny traffic from this source.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 194.61.58.197, located in Skopje, MK, operating on the network of BalkanTel DOO, has been classified as malicious by our automated threat scoring engine. During its 1-day observation window, we recorded 1 hostile requests from this IP — roughly 1 per day on average. The address is classified as residential, meaning it likely belongs to an end-user ISP connection. Malicious activity from residential IPs typically indicates device compromise or botnet membership. The IP exhibits directory enumeration behavior, systematically requesting non-existent paths to discover hidden files and misconfigured resources. With 21 flagged addresses, MK represents a notable presence in our threat database. At 68/100, this IP presents a meaningful threat. Implement rate limiting with escalation to blocking.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
🇲🇰 Top threats from MK
213.135.191.226 (103)92.53.35.143 (103)92.53.35.13 (93)92.53.30.161 (75)45.153.126.81 (70)View all →🏢 Same network: AS44118
View all →Security Intelligence
💡 Directory Traversal Attacks
Path traversal attacks attempt to access files outside the intended directory by manipulating file path references. Attackers use sequences like ../ to reach sensitive system files such as /etc/passwd or application configuration files.
💡 Data Breach Impact Assessment
The impact of data breaches extends beyond immediate financial losses. Regulatory fines, legal liability, reputational damage, and customer churn create long-term costs that often exceed the direct costs of incident response and remediation.