Dashboard›🇮🇹 Italy›172.213.25.50
ABUSE.MOM
THREAT REPORT

IP Threat Report
172.213.25.50

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-08-30 01:26:37
First seen: 2026-08-21 19:11:17
Last seen: 2026-08-30 01:12:51
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 4907.

BURSTDANGER_PATHRATIO_404REDIRECT_PROBEUA_SUS
01

Geolocation & Classification

IP Address
172.213.25.50
Type
Hosting
Country
🇮🇹 Italy
City
Milan
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (italynorth)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
4907
02

Detection Signatures

SignatureDescriptionPointsSeverity
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst 101/10sAbnormally fast request rate — automated scanning+35
Burst 103/10sAbnormally fast request rate — automated scanning+35
Burst 104/10sAbnormally fast request rate — automated scanning+35
Burst 105/10sAbnormally fast request rate — automated scanning+35
Burst 106/10sAbnormally fast request rate — automated scanning+35
Burst 107/10sAbnormally fast request rate — automated scanning+35
Burst 109/10sAbnormally fast request rate — automated scanning+35
Burst 110/10sAbnormally fast request rate — automated scanning+35
Burst 111/10sAbnormally fast request rate — automated scanning+35
Burst 112/10sAbnormally fast request rate — automated scanning+35
Burst 113/10sAbnormally fast request rate — automated scanning+35
Burst 115/10sAbnormally fast request rate — automated scanning+35
Burst 119/10sAbnormally fast request rate — automated scanning+35
Burst 121/10sAbnormally fast request rate — automated scanning+35
Burst 122/10sAbnormally fast request rate — automated scanning+35
Burst 124/10sAbnormally fast request rate — automated scanning+35
Burst 134/10sAbnormally fast request rate — automated scanning+35
Burst 136/10sAbnormally fast request rate — automated scanning+35
Burst 137/10sAbnormally fast request rate — automated scanning+35
Burst 139/10sAbnormally fast request rate — automated scanning+35
Burst 147/10sAbnormally fast request rate — automated scanning+35
Burst 158/10sAbnormally fast request rate — automated scanning+35
Burst 169/10sAbnormally fast request rate — automated scanning+35
Burst 179/10sAbnormally fast request rate — automated scanning+35
Burst 185/10sAbnormally fast request rate — automated scanning+35
Burst 186/10sAbnormally fast request rate — automated scanning+35
Burst 188/10sAbnormally fast request rate — automated scanning+35
Burst 194/10sAbnormally fast request rate — automated scanning+35
Burst 28/2sAbnormally fast request rate — automated scanning+35
Burst 31/2sAbnormally fast request rate — automated scanning+35
Burst 32/2sAbnormally fast request rate — automated scanning+35
Burst 34/2sAbnormally fast request rate — automated scanning+35
Burst 35/2sAbnormally fast request rate — automated scanning+35
Burst 36/2sAbnormally fast request rate — automated scanning+35
Burst 37/2sAbnormally fast request rate — automated scanning+35
Burst 38/2sAbnormally fast request rate — automated scanning+35
Burst 39/2sAbnormally fast request rate — automated scanning+35
Burst 40/2sAbnormally fast request rate — automated scanning+35
Burst 41/2sAbnormally fast request rate — automated scanning+35
Burst 42/2sAbnormally fast request rate — automated scanning+35
Burst 44/2sAbnormally fast request rate — automated scanning+35
Burst 45/2sAbnormally fast request rate — automated scanning+35
Burst 46/2sAbnormally fast request rate — automated scanning+35
Burst 48/2sAbnormally fast request rate — automated scanning+35
Burst 51/2sAbnormally fast request rate — automated scanning+35
Burst 52/2sAbnormally fast request rate — automated scanning+35
Burst 53/2sAbnormally fast request rate — automated scanning+35
Burst 54/2sAbnormally fast request rate — automated scanning+35
Burst 85/10sAbnormally fast request rate — automated scanning+35
Burst 88/10sAbnormally fast request rate — automated scanning+35
Burst 89/10sAbnormally fast request rate — automated scanning+35
Burst 90/10sAbnormally fast request rate — automated scanning+35
Burst 97/10sAbnormally fast request rate — automated scanning+35
Burst 99/10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 100Medium-risk: admin panels, config files+60
Danger medium hits: 104Medium-risk: admin panels, config files+60
Danger medium hits: 142Medium-risk: admin panels, config files+60
Danger medium hits: 152Medium-risk: admin panels, config files+60
Danger medium hits: 172Medium-risk: admin panels, config files+60
Danger medium hits: 176Medium-risk: admin panels, config files+60
Danger medium hits: 184Medium-risk: admin panels, config files+60
Danger medium hits: 190Medium-risk: admin panels, config files+60
Danger medium hits: 2Medium-risk: admin panels, config files+20
Danger medium hits: 214Medium-risk: admin panels, config files+60
Danger medium hits: 218Medium-risk: admin panels, config files+60
Danger medium hits: 226Medium-risk: admin panels, config files+60
Danger medium hits: 232Medium-risk: admin panels, config files+60
Danger medium hits: 255Medium-risk: admin panels, config files+60
Danger medium hits: 256Medium-risk: admin panels, config files+60
Danger medium hits: 257Medium-risk: admin panels, config files+60
Danger medium hits: 314Medium-risk: admin panels, config files+60
Danger medium hits: 344Medium-risk: admin panels, config files+60
Danger medium hits: 348Medium-risk: admin panels, config files+60
Danger medium hits: 404Medium-risk: admin panels, config files+60
Danger medium hits: 444Medium-risk: admin panels, config files+60
Danger medium hits: 490Medium-risk: admin panels, config files+60
Danger medium hits: 60Medium-risk: admin panels, config files+60
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger strong hits: 10High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Danger strong hits: 36High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 5High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 7High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Probe 302→404Behavioral anomaly detected by automated analysis+20
UA suspiciousBehavioral anomaly detected by automated analysis+15
Σ = 4155
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-08-21 19:11:17
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 101/10s (+35)
2026-08-30 01:12:51
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇮🇹 Italy
06

Recommendations

Actions taken & recommended

  • IP 172.213.25.50 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Other malicious IPs detected in the same /24 subnet — consider blocking 172.213.25.0/24
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🔎 Directory Scan Defense

IP 172.213.25.50 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

🌊 Traffic Flood Defense

IP 172.213.25.50 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

🤖 User-Agent Anomaly Defense

IP 172.213.25.50 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

07

Neighbors in 172.213.25.0/24

Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.

172.213.25.203
Score: 280 · Hits: 556
172.213.25.26
Score: 280 · Hits: 3
172.213.25.235
Score: 245 · Hits: 3
09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
b.barracudacentral.org
✓ Clean
dnsbl.dronebl.org
✓ Clean
bl.blocklist.de
✓ Clean
spam.dnsbl.sorbs.net
✓ Clean
psbl.surriel.com
✓ Clean
cbl.abuseat.org
✓ Clean
zen.spamhaus.org

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

172.213.25.50 has been assigned a threat score of 280/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.

The following attack categories were identified:

Path EnumerationRequest FloodingUser-Agent Anomaly

📊 Threat Analysis

Network traffic from 172.213.25.50, located in Milan, Italy, operating on the network of Microsoft Corporation, has been classified as malicious by our automated threat scoring engine. During its 8-day observation window, we recorded 4,907 hostile requests from this IP — roughly 613.4 per day on average. Classified as a hosting IP, this address likely runs on a rented server or cloud instance. Attackers prefer datacenter IPs for their high bandwidth and disposable nature. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. Italy currently accounts for 111 blocked IPs in our database, making it a significant source of malicious traffic. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇮🇹 Top threats from Italy

152.89.168.29 (330)34.17.191.22 (320)141.11.36.94 (305)2.57.170.183 (305)2.57.170.88 (305)View all →

🏢 Same network: AS8075

68.155.155.199 (320)20.127.136.245 (318)72.146.2.133 (280)72.146.44.117 (280)172.213.2.229 (280)View all →
12

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 DNS Amplification Attack Mechanics

DNS amplification exploits open resolvers to reflect and amplify traffic toward victims. A small query triggers a large response directed at the spoofed source IP, achieving amplification factors of 50x or more, overwhelming target bandwidth.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.08.2026 01:26
Behave or get exposed