IP Threat Report
91.199.3.45
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| Danger medium hits: 4 | Medium-risk: admin panels, config files | +40 | |
| Probe pattern 302->404 same path | Behavioral anomaly detected by automated analysis | +20 | |
| Foreign referer seen | Referer from unrelated external domain | +10 | |
| Imported from old blocklist | Behavioral anomaly detected by automated analysis | +0 | |
| Danger medium hits: 10 | Medium-risk: admin panels, config files | +60 | |
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Network Provider
Recommendations
Actions taken & recommended
- IP 91.199.3.45 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Other malicious IPs detected in the same /24 subnet — consider blocking 91.199.3.0/24
- Report abuse to the network provider via their abuse contact
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 91.199.3.45 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
Neighbors in 91.199.3.0/24
Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.
Open Ports & Services
Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.
| Port | Service | Risk | Description |
|---|---|---|---|
| 3389 | RDP | High | Remote Desktop Protocol — primary target for ransomware attacks |
| 5432 | PostgreSQL | High | PostgreSQL database — direct database access risk |
| 5433 | Unknown | Low | Service on port 5433 |
| 6000 | Unknown | Low | Service on port 6000 |
| 6002 | Unknown | Low | Service on port 6002 |
| 6007 | Unknown | Low | Service on port 6007 |
| 6348 | Unknown | Low | Service on port 6348 |
| 6379 | Redis | Critical | Redis in-memory database — frequently misconfigured without auth |
| 6380 | Unknown | Low | Service on port 6380 |
| 6400 | Unknown | Low | Service on port 6400 |
| 6405 | Unknown | Low | Service on port 6405 |
| 6432 | Unknown | Low | Service on port 6432 |
| 6433 | Unknown | Low | Service on port 6433 |
| 6440 | Unknown | Low | Service on port 6440 |
| 6443 | Unknown | Low | Service on port 6443 |
| 6887 | Unknown | Low | Service on port 6887 |
| 6955 | Unknown | Low | Service on port 6955 |
| 7000 | Unknown | Low | Service on port 7000 |
| 7001 | Unknown | Low | Service on port 7001 |
| 7002 | Unknown | Low | Service on port 7002 |
| 7003 | Unknown | Low | Service on port 7003 |
| 7006 | Unknown | Low | Service on port 7006 |
| 7010 | Unknown | Low | Service on port 7010 |
| 7011 | Unknown | Low | Service on port 7011 |
| 7013 | Unknown | Low | Service on port 7013 |
| 7014 | Unknown | Low | Service on port 7014 |
| 7015 | Unknown | Low | Service on port 7015 |
| 7016 | Unknown | Low | Service on port 7016 |
| 7018 | Unknown | Low | Service on port 7018 |
| 7020 | Unknown | Low | Service on port 7020 |
| 7021 | Unknown | Low | Service on port 7021 |
| 7022 | Unknown | Low | Service on port 7022 |
| 7025 | Unknown | Low | Service on port 7025 |
| 7057 | Unknown | Low | Service on port 7057 |
| 7070 | Unknown | Low | Service on port 7070 |
| 7071 | Unknown | Low | Service on port 7071 |
| 7081 | Unknown | Low | Service on port 7081 |
| 7082 | Unknown | Low | Service on port 7082 |
| 7083 | Unknown | Low | Service on port 7083 |
| 7085 | Unknown | Low | Service on port 7085 |
| 7086 | Unknown | Low | Service on port 7086 |
| 7087 | Unknown | Low | Service on port 7087 |
| 7090 | Unknown | Low | Service on port 7090 |
| 7100 | Unknown | Low | Service on port 7100 |
| 7102 | Unknown | Low | Service on port 7102 |
| 7105 | Unknown | Low | Service on port 7105 |
| 7170 | Unknown | Low | Service on port 7170 |
| 7171 | Unknown | Low | Service on port 7171 |
| 7172 | Unknown | Low | Service on port 7172 |
| 7173 | Unknown | Low | Service on port 7173 |
| 7218 | Unknown | Low | Service on port 7218 |
| 8502 | Unknown | Low | Service on port 8502 |
| 9001 | Unknown | Low | Service on port 9001 |
⚠️ Network scanning reveals 3 dangerous services exposed on 91.199.3.45. Exposed RDP (3389) is the #1 entry point for ransomware attacks. Open database ports suggest possible data exfiltration risk. These services should not be publicly accessible without strict firewall rules.
Data source: Shodan InternetDB. Scanned independently of abuse.mom.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
91.199.3.45 has been assigned a threat score of 105/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.
The following attack categories were identified:
📊 Threat Analysis
Our monitoring infrastructure has identified 91.199.3.45, geolocated to Bell, United States, operating on the network of PureVoltage Hosting Inc., as a source of suspicious network activity. During its 26-day observation window, we recorded 8 hostile requests from this IP — roughly 0.3 per day on average. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The IP exhibits directory enumeration behavior, systematically requesting non-existent paths to discover hidden files and misconfigured resources. United States currently accounts for 198 blocked IPs in our database, making it a significant source of malicious traffic. With a threat score of 105/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.
This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.
Related Threats
🇺🇸 Top threats from United States
104.28.246.115 (350)104.28.246.113 (340)104.28.246.116 (340)104.28.235.58 (340)104.28.246.122 (340)View all →Security Intelligence
💡 Command Injection Techniques
Command injection occurs when attackers insert operating system commands through application inputs. Successful exploitation grants direct server access, enabling data theft, malware installation, and lateral movement across networks.
💡 DNS Sinkholing for Malware Defense
DNS sinkholing redirects queries for known malicious domains to controlled IP addresses. This technique blocks malware communication, prevents data exfiltration, and identifies compromised internal hosts attempting to contact command-and-control servers.