Dashboard›🇪🇸 Spain›158.158.105.51

THREAT REPORT

IP Threat Report
158.158.105.51

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 08:18:41

First seen: 2026-02-17 17:25:06

Last seen: 2026-02-22 04:00:08

Geolocation & Classification

IP Address

158.158.105.51

Type

Hosting

Country

🇪🇸 Spain

City

Madrid

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (spaincentral)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

Detection Signatures

Signature	Description	Points
UA suspicious (short/empty)	Behavioral anomaly detected by automated analysis	+15
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 128	Medium-risk: admin panels, config files	+60
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
Probe pattern 302->404 same path	Behavioral anomaly detected by automated analysis	+20
Burst: 40 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 86 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 6	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 102	Medium-risk: admin panels, config files	+60
Burst: 104 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 12	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 153	Medium-risk: admin panels, config files	+60
Burst: 39 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 131 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 38 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 128 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 162	Medium-risk: admin panels, config files	+60
Burst: 35 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 114 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 1	High-risk paths: shells, RCE vectors, exploits	+25
Danger medium hits: 1	Medium-risk: admin panels, config files	+10
Burst: 134 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Danger medium hits: 108	Medium-risk: admin panels, config files	+60
Burst: 37 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 118 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 34 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 109 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 30 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 99 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 33 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 107 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 126	Medium-risk: admin panels, config files	+60
Burst: 110 req / 10s	Abnormally fast request rate — automated scanning	+35
Imported from old blocklist	Behavioral anomaly detected by automated analysis	+0
Danger medium hits: 130	Medium-risk: admin panels, config files	+60
Burst: 43 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 145 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 10	Medium-risk: admin panels, config files	+60
Burst: 129 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 127 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Burst: 12 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 12 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 8	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 195	Medium-risk: admin panels, config files	+60
Burst: 41 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 125 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 15	Medium-risk: admin panels, config files	+60
Burst: 22 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 24 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 139 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 46 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 163 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 151 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 2	Medium-risk: admin panels, config files	+20
Burst: 17 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 18 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 44 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 144 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 122 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 110	Medium-risk: admin panels, config files	+60
Burst: 126 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 36 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 108 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 55	Medium-risk: admin panels, config files	+60
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst: 55 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 124 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 42 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 137 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 138 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 177	Medium-risk: admin panels, config files	+60
Burst: 119 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 88	Medium-risk: admin panels, config files	+60
Burst: 88 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 105 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 90 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 105	Medium-risk: admin panels, config files	+60
Danger medium hits: 106	Medium-risk: admin panels, config files	+60
Burst: 113 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 106 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 159	Medium-risk: admin panels, config files	+60
Burst: 121 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 216	Medium-risk: admin panels, config files	+60
Burst: 111 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 74	Medium-risk: admin panels, config files	+60
Burst: 74 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 97	Medium-risk: admin panels, config files	+60
Danger medium hits: 227	Medium-risk: admin panels, config files	+60
Burst: 47 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 166 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 15 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 54 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 6	Medium-risk: admin panels, config files	+60
Burst: 9 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 8 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 6 req / 2s	Abnormally fast request rate — automated scanning	+35

Σ = 4215

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-02-17 17:25:06

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

UA suspicious (short/empty) (+15), Danger strong hits: 4 (+100), Danger medium hits: 128 (+60)

2026-02-22 04:00:08

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇪🇸 Spain

Recommendations

Actions taken & recommended

IP 158.158.105.51 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 User-Agent Anomaly Defense

IP 158.158.105.51 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

🔎 Path Enumeration Protection

Block scanning from 158.158.105.51: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Traffic Flood Defense

IP 158.158.105.51 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED

Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

158.158.105.51 has been assigned a threat score of 280/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

The address 158.158.105.51 originates from Madrid, Spain, operating on the network of Microsoft Corporation. It was identified through automated analysis of incoming network traffic across monitored endpoints. The address has been active for 4 days in our monitoring system, producing 83 flagged requests at a rate of ~20.8/day. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. With a threat score of 280/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇪🇸 Top threats from Spain

158.158.33.103 (280)68.221.64.54 (280)158.158.51.6 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →

Security Intelligence

💡 TLS Fingerprinting (JA3/JA4)

TLS fingerprinting creates unique identifiers based on how clients negotiate encrypted connections. The JA3 and JA4 methods generate hashes from TLS ClientHello parameters, enabling identification of specific tools and malware regardless of IP address changes.

💡 Network Segmentation Benefits

Proper network segmentation limits the blast radius of breaches. Even if attackers compromise one segment, properly configured network boundaries prevent lateral movement to critical systems, databases, and administrative interfaces.

🔍 Check Any IP Address

Share this report:

IP Threat Report158.158.105.51

⛔ Verdict: BLOCK