IP Threat Report
31.184.236.37
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger strong hits: 5 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Burst: 5 req / 2s | Abnormally fast request rate — automated scanning | +35 | |
| Imported from old blocklist | Behavioral anomaly detected by automated analysis | +0 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 31.184.236.37 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 31.184.236.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Path Enumeration Protection
Block scanning from 31.184.236.37: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
🌊 Traffic Flood Defense
IP 31.184.236.37 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.
Neighbors in 31.184.236.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 22 | SSH | Low | Secure Shell — common brute force target for remote access |
| 25 | SMTP | Medium | SMTP mail server — can be abused for spam relay |
| 80 | HTTP | Low | HTTP web server — standard web traffic |
| 106 | Unknown | Low | Service on port 106 |
| 110 | POP3 | Low | Service on port 110 |
| 143 | IMAP | Low | Service on port 143 |
| 389 | Unknown | Low | Service on port 389 |
| 443 | HTTPS | Low | HTTPS web server — encrypted web traffic |
| 444 | Unknown | Low | Service on port 444 |
| 636 | Unknown | Low | Service on port 636 |
| 993 | IMAPS | Low | Service on port 993 |
| 3306 | MySQL | High | MySQL database — should never be exposed to the internet |
| 5060 | Unknown | Low | Service on port 5060 |
| 5222 | Unknown | Low | Service on port 5222 |
| 5269 | Unknown | Low | Service on port 5269 |
| 5672 | Unknown | Low | Service on port 5672 |
| 8010 | Unknown | Low | Service on port 8010 |
| 8100 | Unknown | Low | Service on port 8100 |
| 9010 | Unknown | Low | Service on port 9010 |
| 9100 | Unknown | Low | Service on port 9100 |
| 15672 | Unknown | Low | Service on port 15672 |
⚠️ 1 high-risk port detected on 31.184.236.37. These services should not be publicly accessible without strict firewall rules.
| CVE ID | Link |
|---|---|
| CVE-2019-0215 | NVD → |
| CVE-2021-32791 | NVD → |
| CVE-2021-26691 | NVD → |
| CVE-2024-38472 | NVD → |
| CVE-2024-27316 | NVD → |
| CVE-2025-58098 | NVD → |
| CVE-2022-31628 | NVD → |
| CVE-2019-10082 | NVD → |
| CVE-2023-25690 | NVD → |
| CVE-2024-38475 | NVD → |
| CVE-2025-53020 | NVD → |
| CVE-2019-10092 | NVD → |
| CVE-2020-1927 | NVD → |
| CVE-2025-49630 | NVD → |
| CVE-2025-59775 | NVD → |
| CVE-2022-22720 | NVD → |
| CVE-2019-10081 | NVD → |
| CVE-2020-13938 | NVD → |
| CVE-2022-29404 | NVD → |
| CVE-2011-2688 | NVD → |
| CVE-2021-39275 | NVD → |
| CVE-2021-32785 | NVD → |
| CVE-2011-1176 | NVD → |
| CVE-2023-27522 | NVD → |
| CVE-2022-28615 | NVD → |
🔴 This host has 96 known CVEs associated with its exposed services. This volume strongly suggests severely outdated software. Review each CVE in the NVD database.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
31.184.236.37 has been assigned a threat score of 150/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 31.184.236.37, located in Prague, Czech Republic, operating on the network of Bralu Jurjanu biedriba, has been classified as malicious by our automated threat scoring engine. Our sensors captured 3 malicious requests from this address across a 1-day span, reflecting a sustained attack cadence of ~3 requests per day. This residential IP is likely a compromised consumer device. Home routers and IoT equipment with default credentials are prime targets for botnet operators. The dual attack vectors of Path Enumeration combined with Request Flooding indicate a coordinated assault rather than opportunistic scanning. Our records show 90 malicious IPs originating from Czech Republic, positioning it as a notable contributor to global threat activity. A score of 150/100 places this address in the top tier of severity. Block and investigate any historical connections.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
🇨🇿 Top threats from Czech Republic
82.118.30.24 (255)82.118.30.31 (255)82.118.30.19 (255)82.118.30.22 (255)82.118.30.12 (255)View all →Security Intelligence
💡 WordPress-Specific Attack Vectors
WordPress sites face constant automated attacks targeting xmlrpc.php for brute force amplification, wp-login.php for credential theft, and vulnerable plugins for remote code execution. Over 90% of CMS-based attacks specifically target WordPress installations.
💡 Tor Exit Node Detection
Tor exit nodes are publicly listed but constantly rotating. While Tor serves essential privacy functions for journalists and activists, it is also used to anonymize attacks. Effective security policies differentiate between blocking and monitoring Tor traffic.