IP Threat Report
36.212.132.184
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| UA bot: Go-http-client | Known bot/crawler User-Agent detected | +40 | |
| Danger strong hits: 14 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Burst: 6 req / 2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst: 14 req / 10s | Abnormally fast request rate — automated scanning | +35 | |
| Foreign referer seen | Referer from unrelated external domain | +10 | |
| Danger strong hits: 28 | High-risk paths: shells, RCE vectors, exploits | +100 | |
| Burst: 12 req / 2s | Abnormally fast request rate — automated scanning | +35 | |
| Burst: 28 req / 10s | Abnormally fast request rate — automated scanning | +35 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 36.212.132.184 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🤖 Bot Detection
Address UA spoofing from 36.212.132.184: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.
🌊 Traffic Flood Defense
IP 36.212.132.184 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 22 | SSH | Low | Secure Shell — common brute force target for remote access |
| CVE ID | Link |
|---|---|
| CVE-2020-15778 | NVD → |
| CVE-2023-51767 | NVD → |
| CVE-2007-2768 | NVD → |
| CVE-2021-41617 | NVD → |
| CVE-2023-51385 | NVD → |
| CVE-2019-16905 | NVD → |
| CVE-2020-14145 | NVD → |
| CVE-2008-3844 | NVD → |
| CVE-2023-48795 | NVD → |
| CVE-2025-32728 | NVD → |
| CVE-2016-20012 | NVD → |
| CVE-2025-26465 | NVD → |
| CVE-2023-38408 | NVD → |
| CVE-2021-36368 | NVD → |
🔴 This host has 14 known CVEs associated with its exposed services. This volume strongly suggests severely outdated software. Review each CVE in the NVD database.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
36.212.132.184 has been assigned a threat score of 220/100 (Critical). This is a critical-level threat. Systems administrators should treat this IP as hostile and block all inbound connections without exception.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 36.212.132.184, located in Guangzhou, China, operating on the network of China Mobile Communications Group Co., Ltd., has been classified as malicious by our automated threat scoring engine. During its 1-day observation window, we recorded 2 hostile requests from this IP — roughly 2 per day on average. The address belongs to a mobile carrier network. The sustained pattern of malicious requests indicates either a compromised device or deliberate abuse. The dual attack vectors of User-Agent Anomaly combined with Request Flooding indicate a coordinated assault rather than opportunistic scanning. China currently accounts for 194 blocked IPs in our database, making it a significant source of malicious traffic. With a threat score of 220/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.
Related Threats
Security Intelligence
💡 HTTP Header Analysis for Threat Detection
Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.
💡 Deception Technology Beyond Honeypots
Modern deception technology deploys fake credentials, decoy files, and breadcrumbs throughout production environments. When attackers interact with these deceptions, high-fidelity alerts trigger with virtually zero false positives.