Dashboard›🇷🇺 Russia›217.116.58.120
ABUSE.MOM
THREAT REPORT

IP Threat Report
217.116.58.120

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-07-26 14:25:47
First seen: 2026-07-24 14:46:58
Last seen: 2026-07-26 14:21:55
68

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 68/100. Total malicious requests observed: 292.

DANGER_PATHMETHODUA_SUS
01

Geolocation & Classification

IP Address
217.116.58.120
Type
VPN
Country
🇷🇺 Russia
City
Tyumen
ISP
Russian company LLC
Organization
JSC Russian Company.
Autonomous System
AS15493 "Russian company" LLC
Hit Count
292
02

Detection Signatures

SignatureDescriptionPointsSeverity
Danger medium hits: 10Medium-risk: admin panels, config files+60
Danger medium hits: 1010Medium-risk: admin panels, config files+60
Danger medium hits: 1012Medium-risk: admin panels, config files+60
Danger medium hits: 1054Medium-risk: admin panels, config files+60
Danger medium hits: 106Medium-risk: admin panels, config files+60
Danger medium hits: 1082Medium-risk: admin panels, config files+60
Danger medium hits: 1092Medium-risk: admin panels, config files+60
Danger medium hits: 113Medium-risk: admin panels, config files+60
Danger medium hits: 1141Medium-risk: admin panels, config files+60
Danger medium hits: 1153Medium-risk: admin panels, config files+60
Danger medium hits: 1212Medium-risk: admin panels, config files+60
Danger medium hits: 1221Medium-risk: admin panels, config files+60
Danger medium hits: 1273Medium-risk: admin panels, config files+60
Danger medium hits: 1290Medium-risk: admin panels, config files+60
Danger medium hits: 1339Medium-risk: admin panels, config files+60
Danger medium hits: 1368Medium-risk: admin panels, config files+60
Danger medium hits: 1429Medium-risk: admin panels, config files+60
Danger medium hits: 143Medium-risk: admin panels, config files+60
Danger medium hits: 147Medium-risk: admin panels, config files+60
Danger medium hits: 1493Medium-risk: admin panels, config files+60
Danger medium hits: 1548Medium-risk: admin panels, config files+60
Danger medium hits: 1613Medium-risk: admin panels, config files+60
Danger medium hits: 1671Medium-risk: admin panels, config files+60
Danger medium hits: 1730Medium-risk: admin panels, config files+60
Danger medium hits: 1790Medium-risk: admin panels, config files+60
Danger medium hits: 180Medium-risk: admin panels, config files+60
Danger medium hits: 1865Medium-risk: admin panels, config files+60
Danger medium hits: 191Medium-risk: admin panels, config files+60
Danger medium hits: 1930Medium-risk: admin panels, config files+60
Danger medium hits: 1985Medium-risk: admin panels, config files+60
Danger medium hits: 2029Medium-risk: admin panels, config files+60
Danger medium hits: 2062Medium-risk: admin panels, config files+60
Danger medium hits: 2104Medium-risk: admin panels, config files+60
Danger medium hits: 2158Medium-risk: admin panels, config files+60
Danger medium hits: 220Medium-risk: admin panels, config files+60
Danger medium hits: 2217Medium-risk: admin panels, config files+60
Danger medium hits: 222Medium-risk: admin panels, config files+60
Danger medium hits: 2262Medium-risk: admin panels, config files+60
Danger medium hits: 2307Medium-risk: admin panels, config files+60
Danger medium hits: 2348Medium-risk: admin panels, config files+60
Danger medium hits: 2386Medium-risk: admin panels, config files+60
Danger medium hits: 241Medium-risk: admin panels, config files+60
Danger medium hits: 2430Medium-risk: admin panels, config files+60
Danger medium hits: 2468Medium-risk: admin panels, config files+60
Danger medium hits: 2513Medium-risk: admin panels, config files+60
Danger medium hits: 2566Medium-risk: admin panels, config files+60
Danger medium hits: 260Medium-risk: admin panels, config files+60
Danger medium hits: 261Medium-risk: admin panels, config files+60
Danger medium hits: 2610Medium-risk: admin panels, config files+60
Danger medium hits: 2656Medium-risk: admin panels, config files+60
Danger medium hits: 2701Medium-risk: admin panels, config files+60
Danger medium hits: 2741Medium-risk: admin panels, config files+60
Danger medium hits: 276Medium-risk: admin panels, config files+60
Danger medium hits: 2786Medium-risk: admin panels, config files+60
Danger medium hits: 2825Medium-risk: admin panels, config files+60
Danger medium hits: 2870Medium-risk: admin panels, config files+60
Danger medium hits: 2915Medium-risk: admin panels, config files+60
Danger medium hits: 292Medium-risk: admin panels, config files+60
Danger medium hits: 2954Medium-risk: admin panels, config files+60
Danger medium hits: 298Medium-risk: admin panels, config files+60
Danger medium hits: 2993Medium-risk: admin panels, config files+60
Danger medium hits: 3033Medium-risk: admin panels, config files+60
Danger medium hits: 307Medium-risk: admin panels, config files+60
Danger medium hits: 3073Medium-risk: admin panels, config files+60
Danger medium hits: 3107Medium-risk: admin panels, config files+60
Danger medium hits: 3152Medium-risk: admin panels, config files+60
Danger medium hits: 3193Medium-risk: admin panels, config files+60
Danger medium hits: 321Medium-risk: admin panels, config files+60
Danger medium hits: 3230Medium-risk: admin panels, config files+60
Danger medium hits: 3293Medium-risk: admin panels, config files+60
Danger medium hits: 3337Medium-risk: admin panels, config files+60
Danger medium hits: 335Medium-risk: admin panels, config files+60
Danger medium hits: 3372Medium-risk: admin panels, config files+60
Danger medium hits: 339Medium-risk: admin panels, config files+60
Danger medium hits: 3409Medium-risk: admin panels, config files+60
Danger medium hits: 3450Medium-risk: admin panels, config files+60
Danger medium hits: 3491Medium-risk: admin panels, config files+60
Danger medium hits: 351Medium-risk: admin panels, config files+60
Danger medium hits: 3526Medium-risk: admin panels, config files+60
Danger medium hits: 3565Medium-risk: admin panels, config files+60
Danger medium hits: 3607Medium-risk: admin panels, config files+60
Danger medium hits: 364Medium-risk: admin panels, config files+60
Danger medium hits: 3649Medium-risk: admin panels, config files+60
Danger medium hits: 3684Medium-risk: admin panels, config files+60
Danger medium hits: 3726Medium-risk: admin panels, config files+60
Danger medium hits: 377Medium-risk: admin panels, config files+60
Danger medium hits: 3772Medium-risk: admin panels, config files+60
Danger medium hits: 381Medium-risk: admin panels, config files+60
Danger medium hits: 3821Medium-risk: admin panels, config files+60
Danger medium hits: 3882Medium-risk: admin panels, config files+60
Danger medium hits: 39Medium-risk: admin panels, config files+60
Danger medium hits: 392Medium-risk: admin panels, config files+60
Danger medium hits: 3930Medium-risk: admin panels, config files+60
Danger medium hits: 3983Medium-risk: admin panels, config files+60
Danger medium hits: 4Medium-risk: admin panels, config files+40
Danger medium hits: 4031Medium-risk: admin panels, config files+60
Danger medium hits: 407Medium-risk: admin panels, config files+60
Danger medium hits: 4079Medium-risk: admin panels, config files+60
Danger medium hits: 4119Medium-risk: admin panels, config files+60
Danger medium hits: 4157Medium-risk: admin panels, config files+60
Danger medium hits: 419Medium-risk: admin panels, config files+60
Danger medium hits: 4194Medium-risk: admin panels, config files+60
Danger medium hits: 422Medium-risk: admin panels, config files+60
Danger medium hits: 437Medium-risk: admin panels, config files+60
Danger medium hits: 452Medium-risk: admin panels, config files+60
Danger medium hits: 4570Medium-risk: admin panels, config files+60
Danger medium hits: 466Medium-risk: admin panels, config files+60
Danger medium hits: 479Medium-risk: admin panels, config files+60
Danger medium hits: 495Medium-risk: admin panels, config files+60
Danger medium hits: 509Medium-risk: admin panels, config files+60
Danger medium hits: 523Medium-risk: admin panels, config files+60
Danger medium hits: 529Medium-risk: admin panels, config files+60
Danger medium hits: 538Medium-risk: admin panels, config files+60
Danger medium hits: 554Medium-risk: admin panels, config files+60
Danger medium hits: 571Medium-risk: admin panels, config files+60
Danger medium hits: 576Medium-risk: admin panels, config files+60
Danger medium hits: 586Medium-risk: admin panels, config files+60
Danger medium hits: 603Medium-risk: admin panels, config files+60
Danger medium hits: 618Medium-risk: admin panels, config files+60
Danger medium hits: 62Medium-risk: admin panels, config files+60
Danger medium hits: 627Medium-risk: admin panels, config files+60
Danger medium hits: 631Medium-risk: admin panels, config files+60
Danger medium hits: 647Medium-risk: admin panels, config files+60
Danger medium hits: 663Medium-risk: admin panels, config files+60
Danger medium hits: 677Medium-risk: admin panels, config files+60
Danger medium hits: 684Medium-risk: admin panels, config files+60
Danger medium hits: 695Medium-risk: admin panels, config files+60
Danger medium hits: 710Medium-risk: admin panels, config files+60
Danger medium hits: 727Medium-risk: admin panels, config files+60
Danger medium hits: 745Medium-risk: admin panels, config files+60
Danger medium hits: 746Medium-risk: admin panels, config files+60
Danger medium hits: 764Medium-risk: admin panels, config files+60
Danger medium hits: 77Medium-risk: admin panels, config files+60
Danger medium hits: 781Medium-risk: admin panels, config files+60
Danger medium hits: 802Medium-risk: admin panels, config files+60
Danger medium hits: 803Medium-risk: admin panels, config files+60
Danger medium hits: 829Medium-risk: admin panels, config files+60
Danger medium hits: 852Medium-risk: admin panels, config files+60
Danger medium hits: 874Medium-risk: admin panels, config files+60
Danger medium hits: 878Medium-risk: admin panels, config files+60
Danger medium hits: 902Medium-risk: admin panels, config files+60
Danger medium hits: 926Medium-risk: admin panels, config files+60
Danger medium hits: 952Medium-risk: admin panels, config files+60
Danger medium hits: 954Medium-risk: admin panels, config files+60
Danger medium hits: 978Medium-risk: admin panels, config files+60
POST seenBehavioral anomaly detected by automated analysis+8
UA suspiciousBehavioral anomaly detected by automated analysis+15
Σ = 8703
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
Requests shown: 1 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-07-24 14:46:58
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
Danger medium hits: 10 (+60), Danger medium hits: 1010 (+60), Danger medium hits: 1012 (+60)
2026-07-26 14:21:55
Last malicious request observed
Total score reached: 68/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Russian company LLC
AS15493 · 🇷🇺 Russia
06

Recommendations

Actions taken & recommended

  • IP 217.116.58.120 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Other malicious IPs detected in the same /24 subnet — consider blocking 217.116.58.0/24
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 217.116.58.120: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

07

Neighbors in 217.116.58.0/24

Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.

217.116.58.22
Score: 148 · Hits: 518
217.116.58.245
Score: 148 · Hits: 366
217.116.58.230
Score: 148 · Hits: 10
217.116.58.12
Score: 108 · Hits: 169
217.116.58.177
Score: 108 · Hits: 76
217.116.58.225
Score: 108 · Hits: 6
217.116.58.9
Score: 108 · Hits: 5
217.116.58.47
Score: 108 · Hits: 5
217.116.58.67
Score: 108 · Hits: 2
217.116.58.5
Score: 108 · Hits: 1
217.116.58.229
Score: 108 · Hits: 1
217.116.58.7
Score: 108 · Hits: 1
09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
spam.dnsbl.sorbs.net
✓ Clean
zen.spamhaus.org
✓ Clean
bl.spamcop.net
✓ Clean
bl.blocklist.de
✓ Clean
cbl.abuseat.org
✓ Clean
b.barracudacentral.org
✓ Clean
psbl.surriel.com
✓ Clean
dnsbl.dronebl.org

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

217.116.58.120 has been assigned a threat score of 68/100 (High). This classifies it as a high-severity threat. Proactive blocking is recommended for sensitive infrastructure.

The following attack categories were identified:

User-Agent Anomaly

📊 Threat Analysis

Threat intelligence analysis has linked 217.116.58.120 to malicious activity originating from Tyumen, Russia, operating on the network of Russian company LLC. The address has been under observation since its initial detection. During its 1-day observation window, we recorded 292 hostile requests from this IP — roughly 292 per day on average. This IP is identified as a VPN or proxy endpoint, commonly used to mask the true origin of attack traffic and bypass geographic or reputation-based blocking. The IP exhibits User-Agent manipulation, switching between different browser identities or sending empty headers. With 128 flagged addresses, Russia represents a significant presence in our threat database. The score of 68/100 warrants active monitoring and rate-limiting. Full blocking is advisable for sensitive systems.

This IP is associated with a VPN or proxy service. Attackers frequently route their traffic through anonymizing services to obscure their true location. This makes attribution more challenging but the malicious behavior patterns remain detectable.

11

Related Threats

🇷🇺 Top threats from Russia

157.22.102.172 (313)178.130.54.159 (288)185.103.167.63 (265)72.56.191.6 (265)95.182.125.201 (265)View all →

🏢 Same network: AS15493

185.11.4.156 (105)217.116.58.222 (103)217.116.58.147 (103)217.116.58.254 (68)217.116.58.165 (68)View all →
12

Security Intelligence

💡 Vulnerability Scanning Explained

Vulnerability scanning is the automated process of probing web applications for known weaknesses. Attackers use tools like Nuclei, Nikto, and ZAP to test thousands of hosts per hour, looking for exposed configuration files, outdated software, and default credentials.

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 26.07.2026 14:25
Behave or get exposed