ABUSE.MOM
威胁报告

IP威胁报告
151.115.165.184

ABUSE.MOM — 规矩点,否则你将被曝光

生成时间: 2026-05-30 16:12:54
首次发现: 2026-05-02 11:00:06
最后发现: 2026-05-02 11:00:06
80

⛔ 判定:封锁

该IP地址已被归类为自动化恶意活动的来源。 威胁评分: 80/100. 已观察到的恶意请求总数: 1.

BURSTREFERER
01

地理位置与分类

IP地址
151.115.165.184
类型
Hosting
国家
🇮🇹 Italy
城市
Milan
ISP
Scaleway
组织
Unknown
自治系统
AS12876 Scaleway SAS
请求次数
1
02

检测签名

签名描述分数严重性
Burst: 19 req / 2s请求频率异常——自动扫描+35
Burst: 27 req / 10s请求频率异常——自动扫描+35
Foreign referer seen来自无关外部域名的Referer+10
Σ = 80
03

观察到的活动

从服务器访问日志重建的HTTP请求。出于安全考虑,目标域名已隐藏。

[redacted]
GET
/
200
[redacted]
GET
/page
200
显示请求: 2 · HTTP 404: 0 · 危险模式: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

时间线

2026-05-02 11:00:06
检测到首次恶意请求
IP已从服务器日志进入监控
观察期间
触发了多个检测签名
Burst: 19 req / 2s (+35), Burst: 27 req / 10s (+35), Foreign referer seen (+10)
2026-05-02 11:00:06
观察到最后一次恶意请求
总分达到: 80/100
下一周期
IP已封锁——所有后续请求被拒绝(HTTP 403)
自动添加到封锁列表
05

网络供应商

Scaleway
AS12876 · 🇮🇹 Italy
06

建议

已采取和建议的措施

  • IP 151.115.165.184 已在应用层封锁(HTTP 403)
  • 建议在防火墙层(iptables/CSF)进行封锁
  • 通过abuse联系方式向网络供应商举报
  • 确保敏感文件(.env、.git、备份)无法从网络访问

🌊 洪水/DDoS缓解

在nginx中实施limit_req_zone。部署具有DDoS防护的CDN。配置SYN cookies和连接跟踪以限制151.115.165.184。

09

黑名单状态 (DNSBL)

该IP已通过全球邮件服务器和防火墙使用的主要DNS黑名单进行检查。

✓ 清洁
ix.dnsbl.manitu.net
✓ 清洁
dnsbl.sorbs.net
✓ 清洁
bl.spamcop.net
✓ 清洁
zen.spamhaus.org
✓ 清洁
dnsbl-1.uceprotect.net
✓ 清洁
b.barracudacentral.org
✓ 清洁
psbl.surriel.com
✓ 清洁
truncate.gbudb.net

已检查:Spamhaus、SpamCop、Barracuda、SORBS、CBL、UCEProtect。

10

Threat Analysis

151.115.165.184 has been assigned a threat score of 80/100 (Critical). 这是一个严重级别的威胁。系统管理员应将此IP视为敌对地址,无例外地阻止所有入站连接。

The following attack categories were identified:

Request Flooding

📊 Threat Analysis

我们的监控基础设施已将151.115.165.184(地理位置为Milan, Italy,运营在Scaleway的网络中)识别为可疑网络活动的来源。 该地址在我们的监控系统中活跃了1天,产生了1次标记请求,速率约为每天1次。 该IP从数据中心基础设施运营,是有组织攻击行动中使用的典型地址。 来自此IP的基于速率的攻击旨在通过大量请求洪水压垮服务器资源。 威胁评分80/100将此IP置于高风险类别。建议在防火墙级别进行封锁。

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇮🇹 Top threats from Italy

View all →

🏢 Same network: AS12876

195.154.60.83 (165)51.158.248.215 (160)62.4.24.110 (140)62.4.17.136 (140)195.154.46.191 (140)View all →
12

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 Multi-Factor Authentication Importance

MFA dramatically reduces the effectiveness of credential-based attacks. Even when passwords are compromised through phishing or data breaches, the additional authentication factor prevents unauthorized access in the vast majority of cases.

🔍 Check Any IP Address

Share this report: