Report for IP: 87.192.253.110

Threat LevelCRITICAL85/1003 rule types across 2 attack categories
56 incidents · 3 rule types · active attacker + blocklisted · persistent 42-day campaign · seen 24h ago
PTR N/A
Org / ASN Uztelecom
Country 🇺🇿 Uzbekistan
City Tashkent, Tashkent
Timezone Asia/Tashkent

Attack Analysis

Webshell Upload Scan
This IP rapidly probed multiple non-existent PHP paths in under 60 seconds — a hallmark of automated webshell scanning tools hunting for previously uploaded backdoors or vulnerable file-upload endpoints. If successful, a webshell grants the attacker full remote code execution on the server.
IDS: Threat Intel — CINS Active Threat
This IP appears in the CINS (Collective Intelligence Network Security) Active Threat Intelligence feed — a real-time blocklist of IPs with poor reputation scores derived from observed malicious activity. CINS-listed IPs are actively engaged in attacks at the time of detection.
Suricata IDS Alert
Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (56)

Date Severity Description
1 Sep 2026 - 03:57 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:56 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:54 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:54 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:53 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:51 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:50 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:50 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:49 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:47 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:43 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:39 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:39 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:36 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:35 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:34 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:31 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:30 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:28 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127
1 Sep 2026 - 03:26 high IDS: Threat Intel — CINS poor reputation IP — ET CINS Active Threat Intelligence Poor Reputation IP group 127