Dashboard›🇪🇸 Spain›158.158.32.105
ABUSE.MOM
THREAT REPORT

IP Threat Report
158.158.32.105

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 07:56:06
First seen: 2026-03-03 07:00:06
Last seen: 2026-03-25 11:00:06
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 62.

UA_SUSDANGER_PATHREDIRECT_PROBEBURSTRATIO_404
01

Geolocation & Classification

IP Address
158.158.32.105
Type
Hosting
Country
🇪🇸 Spain
City
Madrid
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (spaincentral)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
62
02

Detection Signatures

SignatureDescriptionPointsSeverity
UA suspicious (short/empty)Behavioral anomaly detected by automated analysis+15
Danger strong hits: 52High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 370Medium-risk: admin panels, config files+60
Probe pattern 302->404 same pathBehavioral anomaly detected by automated analysis+20
Burst: 36 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 117 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 364Medium-risk: admin panels, config files+60
Burst: 38 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 125 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 36High-risk paths: shells, RCE vectors, exploits+100
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
Burst: 46 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 165 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 182Medium-risk: admin panels, config files+60
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst: 40 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 143 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 54High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 512Medium-risk: admin panels, config files+60
Burst: 33 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 103 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 112 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 362Medium-risk: admin panels, config files+60
Burst: 118 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 34 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 109 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 110 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 114 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 366Medium-risk: admin panels, config files+60
Burst: 35 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 116 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 39 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 121 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 368Medium-risk: admin panels, config files+60
Burst: 45 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 153 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 122 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 388Medium-risk: admin panels, config files+60
Burst: 41 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 145 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 402Medium-risk: admin panels, config files+60
Burst: 42 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 137 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 394Medium-risk: admin panels, config files+60
Burst: 134 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 47 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 170 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 172 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 38High-risk paths: shells, RCE vectors, exploits+100
Burst: 130 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 404Medium-risk: admin panels, config files+60
Burst: 44 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 156 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 55High-risk paths: shells, RCE vectors, exploits+100
Burst: 151 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 398Medium-risk: admin panels, config files+60
Burst: 32 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 106 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 37 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 127 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 111 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 70High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 597Medium-risk: admin panels, config files+60
Burst: 142 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 124 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 43 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 107 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 131 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 129 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 50High-risk paths: shells, RCE vectors, exploits+100
Burst: 166 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 171 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 30High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 350Medium-risk: admin panels, config files+60
Burst: 163 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 43High-risk paths: shells, RCE vectors, exploits+100
Burst: 139 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 352Medium-risk: admin panels, config files+60
Danger medium hits: 344Medium-risk: admin panels, config files+60
Burst: 157 req / 10sAbnormally fast request rate — automated scanning+35
Σ = 3820
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-03-03 07:00:06
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
UA suspicious (short/empty) (+15), Danger strong hits: 52 (+100), Danger medium hits: 370 (+60)
2026-03-25 11:00:06
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇪🇸 Spain
06

Recommendations

Actions taken & recommended

  • IP 158.158.32.105 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Other malicious IPs detected in the same /24 subnet — consider blocking 158.158.32.0/24
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 158.158.32.105: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

🔎 Path Enumeration Protection

Block scanning from 158.158.32.105: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Traffic Flood Defense

IP 158.158.32.105 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

07

Neighbors in 158.158.32.0/24

Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.

158.158.32.26
Score: 280 · Hits: 13
158.158.32.90
Score: 280 · Hits: 7
158.158.32.183
Score: 280 · Hits: 6
09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED
Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

158.158.32.105 has been assigned a threat score of 280/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

158.158.32.105 is registered in Madrid, Spain, operating on the network of Microsoft Corporation. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. The address has been active for 22 days in our monitoring system, producing 62 flagged requests at a rate of ~2.8/day. Classified as a hosting IP, this address likely runs on a rented server or cloud instance. Attackers prefer datacenter IPs for their high bandwidth and disposable nature. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. With 101 flagged addresses, Spain represents a significant presence in our threat database. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇪🇸 Top threats from Spain

158.173.36.160 (305)212.30.33.72 (305)45.67.99.32 (305)158.158.33.103 (280)158.158.105.51 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →
12

Security Intelligence

💡 TLS Fingerprinting (JA3/JA4)

TLS fingerprinting creates unique identifiers based on how clients negotiate encrypted connections. The JA3 and JA4 methods generate hashes from TLS ClientHello parameters, enabling identification of specific tools and malware regardless of IP address changes.

💡 Open Source Intelligence Methods

OSINT techniques leverage publicly available information for security research. DNS records, WHOIS data, certificate transparency logs, social media, and code repositories all provide valuable intelligence for threat analysis without requiring special access or tools.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 07:56
Behave or get exposed