IP Threat Report
95.3.69.222
ABUSE.MOM — BEHAVE OR GET EXPOSED
Geolocation & Classification
Detection Signatures
| Signature | Description | Points | Severity |
|---|---|---|---|
| 404 ratio 40-60% | Majority of requests returned 404 — enumeration | +15 | |
| Danger medium hits: 5 | Medium-risk: admin panels, config files | +50 | |
| Directory Scan | Behavioral anomaly detected by automated analysis | +0 | |
| Foreign referer | Referer from unrelated external domain | +10 | |
| Probe 302→404 | Behavioral anomaly detected by automated analysis | +20 |
Observed Activity
Reconstructed HTTP requests from server access logs. Target domains redacted for security.
* Typical request patterns for detected signatures. Actual target domains are redacted.
Timeline
Recommendations
Actions taken & recommended
- IP 95.3.69.222 is blocked at application level (HTTP 403)
- Consider blocking at firewall level (iptables/CSF) to reduce server load
- Ensure sensitive files (.env, .git, backups) are not accessible from the web
🔎 Directory Scan Defense
IP 95.3.69.222 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.
Blacklist Status (DNSBL)
This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.
Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.
Threat Analysis
95.3.69.222 has been assigned a threat score of 105/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.
The following attack categories were identified:
📊 Threat Analysis
IP address 95.3.69.222 has been traced to Istanbul, Turkey, operating on the network of Turk Telekomunikasyon Anonim Sirketi. Our threat detection systems have flagged this address based on observed malicious behavior patterns. During its 40-day observation window, we recorded 826 hostile requests from this IP — roughly 20.7 per day on average. Active path scanning has been detected — this IP probes for hundreds of common file and directory names. Our records show 102 malicious IPs originating from Turkey, positioning it as a significant contributor to global threat activity. With a threat score of 105/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.
Related Threats
🇹🇷 Top threats from Turkey
45.130.202.6 (255)45.130.202.46 (255)45.130.202.33 (255)45.130.202.21 (255)45.130.202.36 (255)View all →Security Intelligence
💡 Prototype Pollution Attacks
Prototype pollution manipulates JavaScript object prototypes to inject properties that affect all objects in an application. This can lead to denial of service, property injection, and in some cases remote code execution in Node.js applications.
💡 Command Injection Techniques
Command injection occurs when attackers insert operating system commands through application inputs. Successful exploitation grants direct server access, enabling data theft, malware installation, and lateral movement across networks.