IP威胁报告
159.89.207.41
ABUSE.MOM — 规矩点，否则你将被曝光
地理位置与分类
检测签名
| 签名 | 描述 | 分数 | 严重性 |
|---|---|---|---|
| UA bot: python | 检测到已知机器人/爬虫的User-Agent | +40 | |
| UA changed for same IP | 多个User-Agent——机器人轮换技术 | +25 | |
| Danger strong hits: 9 | 高风险路径：Webshell、RCE、漏洞利用 | +100 | |
| Danger medium hits: 5 | 中等风险：管理面板、配置文件 | +50 | |
| Burst: 7 req / 2s | 请求频率异常——自动扫描 | +35 | |
| Foreign referer seen | 来自无关外部域名的Referer | +10 |
观察到的活动
从服务器访问日志重建的HTTP请求。出于安全考虑，目标域名已隐藏。
* Typical request patterns for detected signatures. Actual target domains are redacted.
时间线
网络供应商
建议
已采取和建议的措施
- IP 159.89.207.41 已在应用层封锁（HTTP 403）
- 建议在防火墙层（iptables/CSF）进行封锁
- 通过abuse联系方式向网络供应商举报
- 确保敏感文件（.env、.git、备份）无法从网络访问
🤖 User-Agent异常防御
IP 159.89.207.41显示可疑的UA行为。阻止空User-Agent请求。为敏感端点实施基于JavaScript的机器人检测。
🌊 洪水/DDoS缓解
在nginx中实施limit_req_zone。部署具有DDoS防护的CDN。配置SYN cookies和连接跟踪以限制159.89.207.41。
开放端口和服务
来自Shodan的网络侦察数据。开放端口可能表示正在运行的服务、错误配置或潜在的攻击面。
| Port | Service | Risk | Description |
|---|---|---|---|
| 22 | SSH | Low | Secure Shell — common brute force target for remote access |
| 80 | HTTP | Low | HTTP web server — standard web traffic |
| 81 | Unknown | Low | Service on port 81 |
| 143 | IMAP | Low | Service on port 143 |
| 234 | Unknown | Low | Service on port 234 |
| 264 | Unknown | Low | Service on port 264 |
| 285 | Unknown | Low | Service on port 285 |
| 311 | Unknown | Low | Service on port 311 |
| 314 | Unknown | Low | Service on port 314 |
| 389 | Unknown | Low | Service on port 389 |
| 400 | Unknown | Low | Service on port 400 |
| 427 | Unknown | Low | Service on port 427 |
| 440 | Unknown | Low | Service on port 440 |
| 441 | Unknown | Low | Service on port 441 |
| 443 | HTTPS | Low | HTTPS web server — encrypted web traffic |
| 444 | Unknown | Low | Service on port 444 |
| 445 | SMB | Critical | SMB file sharing — high-risk for EternalBlue and ransomware |
| 447 | Unknown | Low | Service on port 447 |
| 449 | Unknown | Low | Service on port 449 |
| 451 | Unknown | Low | Service on port 451 |
| 452 | Unknown | Low | Service on port 452 |
| 465 | Unknown | Low | Service on port 465 |
| 480 | Unknown | Low | Service on port 480 |
| 502 | Unknown | Low | Service on port 502 |
| 503 | Unknown | Low | Service on port 503 |
| 513 | Unknown | Low | Service on port 513 |
| 515 | Unknown | Low | Service on port 515 |
| 541 | Unknown | Low | Service on port 541 |
| 548 | Unknown | Low | Service on port 548 |
| 554 | Unknown | Low | Service on port 554 |
| 556 | Unknown | Low | Service on port 556 |
| 587 | Unknown | Low | Service on port 587 |
| 591 | Unknown | Low | Service on port 591 |
| 593 | Unknown | Low | Service on port 593 |
| 631 | Unknown | Low | Service on port 631 |
| 636 | Unknown | Low | Service on port 636 |
| 646 | Unknown | Low | Service on port 646 |
| 666 | Unknown | Low | Service on port 666 |
| 685 | Unknown | Low | Service on port 685 |
| 771 | Unknown | Low | Service on port 771 |
| 772 | Unknown | Low | Service on port 772 |
| 777 | Unknown | Low | Service on port 777 |
| 785 | Unknown | Low | Service on port 785 |
| 789 | Unknown | Low | Service on port 789 |
| 806 | Unknown | Low | Service on port 806 |
| 830 | Unknown | Low | Service on port 830 |
| 833 | Unknown | Low | Service on port 833 |
| 843 | Unknown | Low | Service on port 843 |
| 873 | Unknown | Low | Service on port 873 |
| 880 | Unknown | Low | Service on port 880 |
| 886 | Unknown | Low | Service on port 886 |
| 887 | Unknown | Low | Service on port 887 |
| 902 | Unknown | Low | Service on port 902 |
| 953 | Unknown | Low | Service on port 953 |
| 990 | Unknown | Low | Service on port 990 |
| 992 | Unknown | Low | Service on port 992 |
| 993 | IMAPS | Low | Service on port 993 |
| 995 | POP3S | Low | Service on port 995 |
| 1013 | Unknown | Low | Service on port 1013 |
| 2222 | Unknown | Low | Service on port 2222 |
| 2223 | Unknown | Low | Service on port 2223 |
⚠️ 在159.89.207.41上检测到1个高风险端口。SMB (445)暴露与蠕虫传播和EternalBlue漏洞利用相关。 这些服务在没有严格防火墙规则的情况下不应公开访问。
| CVE ID | Link |
|---|---|
| CVE-2025-23419 | NVD → |
| CVE-2023-44487 | NVD → |
| CVE-2021-23017 | NVD → |
| CVE-2021-3618 | NVD → |
🔴 此主机有4个已知CVE与其暴露的服务相关联。多个漏洞表明补丁管理存在漏洞。 请在NVD数据库中查看每个CVE的详细信息。
数据来源：Shodan InternetDB。独立于abuse.mom进行扫描。
黑名单状态 (DNSBL)
该IP已通过全球邮件服务器和防火墙使用的主要DNS黑名单进行检查。
已检查：Spamhaus、SpamCop、Barracuda、SORBS、CBL、UCEProtect。
Threat Analysis
159.89.207.41 has been assigned a threat score of 220/100 (Critical). 如此高的分数标志着一个关键威胁行为者。该地址在多个检测向量上表现出持续的、激进的恶意行为。
The following attack categories were identified:
📊 Threat Analysis
159.89.207.41注册在Singapore, Singapore，运营在DigitalOcean, LLC的网络中。该IP在触发多个行为检测签名后首次出现在我们的威胁源中。 在其3天的观察窗口期间，我们记录了来自此IP的3次敌对请求——平均每天约1次。 此地址属于数据中心或云托管提供商。托管IP经常被专门租用廉价VPS实例来进行攻击的威胁行为者利用。 识别出两种攻击模式（User-Agent Anomaly和Request Flooding），表明这是一个针对多个漏洞的半自动化攻击活动。 Singapore目前在我们的数据库中占40个被封锁IP，使其成为恶意流量的值得注意的来源。 威胁评分220/100，此IP属于我们数据库中最危险的地址之一。强烈建议立即完全封锁。
This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.
Related Threats
Security Intelligence
💡 User-Agent Analysis Techniques
Analyzing User-Agent strings reveals automated tools masquerading as legitimate browsers. Inconsistencies between claimed browser capabilities and actual behavior, impossible version combinations, and known scanner signatures help identify malicious clients.
💡 HTTP Header Analysis for Threat Detection
Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.