IP Threat Report
77.75.79.36
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| UA bot: crawler | Known bot/crawler User-Agent detected | +40 | |
| 404 ratio >= 60% | Majority of requests returned 404 — enumeration | +25 | |
| Imported from old blocklist | Behavioral anomaly detected by automated analysis | +0 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Danger medium hits: 2 | Medium-risk: admin panels, config files | +20 | |
| Probe pattern 302->404 same path | Behavioral anomaly detected by automated analysis | +20 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 77.75.79.36 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 77.75.79.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🤖 User-Agent Anomaly Defense
IP 77.75.79.36 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.
🔎 Path Enumeration Protection
Block scanning from 77.75.79.36: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.
Neighbors in 77.75.79.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
77.75.79.36 has been assigned a threat score of 65/100 (High). This classifies it as a high-severity threat. Proactive blocking is recommended for sensitive infrastructure.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 77.75.79.36, located in Prague, Czech Republic, operating on the network of Seznam - II, has been classified as malicious by our automated threat scoring engine. The address has been active for 70 days in our monitoring system, producing 13 flagged requests at a rate of ~0.2/day. Operating from a residential network, this IP may represent a compromised home gateway or IoT device that has been drafted into a larger attack infrastructure. Two attack patterns were identified (User-Agent Anomaly and Path Enumeration), suggesting a semi-automated campaign that targets multiple vulnerabilities. Our records show 90 malicious IPs originating from Czech Republic, positioning it as a notable contributor to global threat activity. The score of 65/100 warrants active monitoring and rate-limiting. Full blocking is advisable for sensitive systems.
This IP is classified as residential, suggesting it may belong to a compromised home device, IoT botnet member, or an infected personal computer. Residential IPs involved in attacks often indicate malware infection without the owner's knowledge.
Related Threats
🇨🇿 Top threats from Czech Republic
82.118.30.24 (255)82.118.30.31 (255)82.118.30.19 (255)82.118.30.22 (255)82.118.30.12 (255)View all →Security Intelligence
💡 HTTP Header Analysis for Threat Detection
Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.
💡 GeoIP Blocking Considerations
Blocking traffic from specific countries reduces attack surface but impacts legitimate international users. Effective geo-based policies use tiered approaches — blocking, rate limiting, or requiring additional verification based on risk assessment.