IP威胁报告
193.176.237.141
ABUSE.MOM — 规矩点，否则你将被曝光
地理位置与分类
检测签名
| 签名 | 描述 | 分数 | 严重性 |
|---|---|---|---|
| Danger medium hits: 4 | 中等风险：管理面板、配置文件 | +40 | |
| Probe pattern 302->404 same path | 自动分析检测到行为异常 | +20 | |
| Foreign referer seen | 来自无关外部域名的Referer | +10 | |
| Danger medium hits: 10 | 中等风险：管理面板、配置文件 | +60 | |
| 404 ratio 40-60% | 大多数请求返回404——目录枚举 | +15 |
观察到的活动
从服务器访问日志重建的HTTP请求。出于安全考虑，目标域名已隐藏。
* Typical request patterns for detected signatures. Actual target domains are redacted.
时间线
网络供应商
建议
已采取和建议的措施
- IP 193.176.237.141 已在应用层封锁（HTTP 403）
- 建议在防火墙层（iptables/CSF）进行封锁
- 在同一/24子网中检测到其他恶意IP——建议封锁 193.176.237.0/24
- 通过abuse联系方式向网络供应商举报
- 确保敏感文件（.env、.git、备份）无法从网络访问
🔎 目录扫描防御
IP 193.176.237.141正在枚举目录。在10次以上404错误后配置fail2ban apache-404 jail。禁用目录列表。
开放端口和服务
来自Shodan的网络侦察数据。开放端口可能表示正在运行的服务、错误配置或潜在的攻击面。
| Port | Service | Risk | Description |
|---|---|---|---|
| 3389 | RDP | High | Remote Desktop Protocol — primary target for ransomware attacks |
| 5432 | PostgreSQL | High | PostgreSQL database — direct database access risk |
| 5433 | Unknown | Low | Service on port 5433 |
| 6000 | Unknown | Low | Service on port 6000 |
| 6002 | Unknown | Low | Service on port 6002 |
| 6036 | Unknown | Low | Service on port 6036 |
| 6348 | Unknown | Low | Service on port 6348 |
| 6352 | Unknown | Low | Service on port 6352 |
| 6379 | Redis | Critical | Redis in-memory database — frequently misconfigured without auth |
| 6405 | Unknown | Low | Service on port 6405 |
| 6432 | Unknown | Low | Service on port 6432 |
| 6433 | Unknown | Low | Service on port 6433 |
| 6440 | Unknown | Low | Service on port 6440 |
| 6443 | Unknown | Low | Service on port 6443 |
| 6887 | Unknown | Low | Service on port 6887 |
| 6998 | Unknown | Low | Service on port 6998 |
| 7000 | Unknown | Low | Service on port 7000 |
| 7001 | Unknown | Low | Service on port 7001 |
| 7005 | Unknown | Low | Service on port 7005 |
| 7007 | Unknown | Low | Service on port 7007 |
| 7010 | Unknown | Low | Service on port 7010 |
| 7012 | Unknown | Low | Service on port 7012 |
| 7013 | Unknown | Low | Service on port 7013 |
| 7014 | Unknown | Low | Service on port 7014 |
| 7015 | Unknown | Low | Service on port 7015 |
| 7018 | Unknown | Low | Service on port 7018 |
| 7021 | Unknown | Low | Service on port 7021 |
| 7022 | Unknown | Low | Service on port 7022 |
| 7025 | Unknown | Low | Service on port 7025 |
| 7070 | Unknown | Low | Service on port 7070 |
| 7071 | Unknown | Low | Service on port 7071 |
| 7078 | Unknown | Low | Service on port 7078 |
| 7079 | Unknown | Low | Service on port 7079 |
| 7081 | Unknown | Low | Service on port 7081 |
| 7083 | Unknown | Low | Service on port 7083 |
| 7084 | Unknown | Low | Service on port 7084 |
| 7085 | Unknown | Low | Service on port 7085 |
| 7086 | Unknown | Low | Service on port 7086 |
| 7087 | Unknown | Low | Service on port 7087 |
| 7090 | Unknown | Low | Service on port 7090 |
| 7100 | Unknown | Low | Service on port 7100 |
| 7170 | Unknown | Low | Service on port 7170 |
| 7171 | Unknown | Low | Service on port 7171 |
| 7172 | Unknown | Low | Service on port 7172 |
| 7173 | Unknown | Low | Service on port 7173 |
| 7218 | Unknown | Low | Service on port 7218 |
| 8502 | Unknown | Low | Service on port 8502 |
| 9001 | Unknown | Low | Service on port 9001 |
⚠️ 在193.176.237.141上检测到3个高风险端口。暴露的RDP (3389)是勒索软件攻击的首要入口。 开放的数据库端口表明可能存在数据泄露风险。 这些服务在没有严格防火墙规则的情况下不应公开访问。
数据来源：Shodan InternetDB。独立于abuse.mom进行扫描。
黑名单状态 (DNSBL)
该IP已通过全球邮件服务器和防火墙使用的主要DNS黑名单进行检查。
已检查：Spamhaus、SpamCop、Barracuda、SORBS、CBL、UCEProtect。
Threat Analysis
193.176.237.141 has been assigned a threat score of 105/100 (Critical). 如此高的分数标志着一个关键威胁行为者。该地址在多个检测向量上表现出持续的、激进的恶意行为。
The following attack categories were identified:
📊 Threat Analysis
193.176.237.141注册在Ashland, United States，运营在PureVoltage Hosting Inc.的网络中。该IP在触发多个行为检测签名后首次出现在我们的威胁源中。 在其26天的观察窗口期间，我们记录了来自此IP的8次敌对请求——平均每天约0.3次。 该IP从数据中心基础设施运营，是有组织攻击行动中使用的典型地址。 该IP表现出目录枚举行为，系统地请求不存在的路径以发现隐藏文件和配置错误的资源。 我们的记录显示来自United States的198个恶意IP，使其成为全球威胁活动的重要贡献者。 评分105/100将此地址置于最高严重性级别。应封锁并调查任何历史连接。
This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.
Related Threats
🇺🇸 Top threats from United States
104.28.246.115 (350)104.28.246.113 (340)104.28.246.116 (340)104.28.235.58 (340)104.28.246.122 (340)View all →Security Intelligence
💡 WordPress-Specific Attack Vectors
WordPress sites face constant automated attacks targeting xmlrpc.php for brute force amplification, wp-login.php for credential theft, and vulnerable plugins for remote code execution. Over 90% of CMS-based attacks specifically target WordPress installations.
💡 Ransomware-as-a-Service Economy
The RaaS model allows technically unskilled criminals to deploy sophisticated ransomware through affiliate programs. Operators provide the malware, infrastructure, and negotiation services, taking a percentage of ransom payments from their affiliates.