IP Threat Report
84.115.238.228
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Danger medium hits: 2 | Medium-risk: admin panels, config files | +20 | |
| POST seen | Behavioral anomaly detected by automated analysis | +8 | |
| UA changed | Multiple User-Agents — bot rotation technique | +25 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 84.115.238.228 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 84.115.238.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 84.115.238.228 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
🤖 Bot Detection
Address UA spoofing from 84.115.238.228: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.
Neighbors in 84.115.238.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
84.115.238.228 has been assigned a threat score of 68/100 (High). At this threat level, the IP is considered high risk. Firewall rules should be updated to deny traffic from this source.
The following attack categories were identified:
📊 Threat Analysis
Network traffic from 84.115.238.228, located in Vienna, Austria, operating on the network of Liberty Global Operations B.V, has been classified as malicious by our automated threat scoring engine. Over a period of 1 days, this IP generated 23 malicious requests, averaging approximately 23 requests per day. The address belongs to a mobile carrier network. The sustained pattern of malicious requests indicates either a compromised device or deliberate abuse. The dual attack vectors of Path Enumeration combined with User-Agent Anomaly indicate a coordinated assault rather than opportunistic scanning. With 70 flagged addresses, Austria represents a notable presence in our threat database. The score of 68/100 warrants active monitoring and rate-limiting. Full blocking is advisable for sensitive systems.
Related Threats
🇦🇹 Top threats from Austria
45.95.243.132 (280)45.95.243.145 (280)89.187.168.57 (255)45.95.243.39 (255)45.95.243.12 (255)View all →Security Intelligence
💡 API Abuse and Enumeration
Modern attacks increasingly target APIs rather than traditional web interfaces. Attackers enumerate endpoints, test for broken authentication, and exploit excessive data exposure. API attacks are harder to detect as they mimic legitimate programmatic access patterns.
💡 Content Security Policy Implementation
Content Security Policy headers instruct browsers to restrict resource loading, mitigating XSS and data injection attacks. Properly configured CSP policies prevent inline script execution, restrict iframe embedding, and control which domains can serve content.