Dashboard›🇮🇹 Italy›172.213.16.18

THREAT REPORT

IP Threat Report
172.213.16.18

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 08:21:41

First seen: 2026-02-17 17:25:06

Last seen: 2026-02-21 12:55:04

Geolocation & Classification

IP Address

172.213.16.18

Type

Hosting

Country

🇮🇹 Italy

City

Milan

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (italynorth)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

Detection Signatures

Signature	Description	Points
UA suspicious (short/empty)	Behavioral anomaly detected by automated analysis	+15
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 126	Medium-risk: admin panels, config files	+60
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
Probe pattern 302->404 same path	Behavioral anomaly detected by automated analysis	+20
Burst: 44 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 123 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 6	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 128	Medium-risk: admin panels, config files	+60
Burst: 39 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 128 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 48 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 53 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 157 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 50 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 158 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 28 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 87 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 37 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 120 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 144 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Danger medium hits: 108	Medium-risk: admin panels, config files	+60
Burst: 59 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 162 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 52 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 171 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 49 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 159 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 173 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 164 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 46 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 154 req / 10s	Abnormally fast request rate — automated scanning	+35
Imported from old blocklist	Behavioral anomaly detected by automated analysis	+0
Danger strong hits: 8	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 192	Medium-risk: admin panels, config files	+60
Burst: 47 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 155 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 56 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 191 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 195	Medium-risk: admin panels, config files	+60
Burst: 148 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 130	Medium-risk: admin panels, config files	+60
Burst: 55 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 188 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 146 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 130 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 41 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 132 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 118	Medium-risk: admin panels, config files	+60
Burst: 113 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 77	Medium-risk: admin panels, config files	+60
Burst: 38 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 102 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Danger medium hits: 65	Medium-risk: admin panels, config files	+60
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst: 65 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 184 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 57 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 195 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 58 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 54 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 110	Medium-risk: admin panels, config files	+60
Burst: 107 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 110 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 140 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 165	Medium-risk: admin panels, config files	+60
Burst: 42 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 139 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 152 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 106	Medium-risk: admin panels, config files	+60
Burst: 86 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 159	Medium-risk: admin panels, config files	+60
Burst: 200 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 70	Medium-risk: admin panels, config files	+60
Burst: 43 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 104 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 124 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 68	Medium-risk: admin panels, config files	+60
Danger medium hits: 38	Medium-risk: admin panels, config files	+60
Burst: 57 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 36 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 105 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 216	Medium-risk: admin panels, config files	+60
Burst: 165 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 78	Medium-risk: admin panels, config files	+60
Burst: 117 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 138	Medium-risk: admin panels, config files	+60
Burst: 166 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 98 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 324	Medium-risk: admin panels, config files	+60
Burst: 106 req / 10s	Abnormally fast request rate — automated scanning	+35

Σ = 3975

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-02-17 17:25:06

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

UA suspicious (short/empty) (+15), Danger strong hits: 4 (+100), Danger medium hits: 126 (+60)

2026-02-21 12:55:04

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇮🇹 Italy

Recommendations

Actions taken & recommended

IP 172.213.16.18 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 User-Agent Anomaly Defense

IP 172.213.16.18 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

🔎 Path Enumeration Protection

Block scanning from 172.213.16.18: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Traffic Flood Defense

IP 172.213.16.18 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED

Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

172.213.16.18 has been assigned a threat score of 280/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

The address 172.213.16.18 originates from Milan, Italy, operating on the network of Microsoft Corporation. It was identified through automated analysis of incoming network traffic across monitored endpoints. The address has been active for 3 days in our monitoring system, producing 58 flagged requests at a rate of ~19.3/day. The IP is classified as hosting/datacenter infrastructure, commonly associated with rented servers used for automated attack campaigns, botnet command-and-control, or vulnerability scanning at scale. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇮🇹 Top threats from Italy

4.232.88.90 (280)4.232.89.175 (280)4.232.90.25 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →

Security Intelligence

💡 User-Agent Analysis Techniques

Analyzing User-Agent strings reveals automated tools masquerading as legitimate browsers. Inconsistencies between claimed browser capabilities and actual behavior, impossible version combinations, and known scanner signatures help identify malicious clients.

💡 SQL Injection Campaigns

SQL injection remains one of the most common web attack vectors. Attackers inject malicious SQL code through input fields to extract database contents, modify data, or gain administrative access. Automated scanners test for SQLi vulnerabilities at massive scale.

🔍 Check Any IP Address

Share this report:

IP Threat Report172.213.16.18

⛔ Verdict: BLOCK