Dashboard›🇫🇷 France›35.180.198.159
ABUSE.MOM
THREAT REPORT

IP Threat Report
35.180.198.159

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 06:31:03
First seen: 2026-04-13 14:00:06
Last seen: 2026-04-13 16:00:06
263

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 263/100. Total malicious requests observed: 72.

DANGER_PATHBURSTMETHODRATIO_404
01

Geolocation & Classification

IP Address
35.180.198.159
Type
Hosting
Country
🇫🇷 France
City
Paris
ISP
Amazon Technologies Inc.
Organization
AWS EC2 (eu-west-3)
Autonomous System
AS16509 Amazon.com, Inc.
Hit Count
72
02

Detection Signatures

SignatureDescriptionPointsSeverity
Danger strong hits: 448High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 64Medium-risk: admin panels, config files+60
Burst: 53 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 193 req / 10sAbnormally fast request rate — automated scanning+35
POST requests presentBehavioral anomaly detected by automated analysis+8
Danger strong hits: 150High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 30Medium-risk: admin panels, config files+60
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst: 46 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 164 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 51 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 186 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 181 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 183 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 180 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 48 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 173 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 174 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 49 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 171 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 176 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 45 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 162 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 177 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 179 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 55 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 195 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 170 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 175 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 160 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 442High-risk paths: shells, RCE vectors, exploits+100
Burst: 159 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 156 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 52 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 44 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 158 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 154 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 42 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 151 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 192 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 184 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 189 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 187 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 47 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 167 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 40 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 136 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 161 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 182 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 16 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 47 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 14 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 42 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 44 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 48 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 51 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 49 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 15 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 45 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 46 req / 10sAbnormally fast request rate — automated scanning+35
Σ = 2448
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-04-13 14:00:06
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
Danger strong hits: 448 (+100), Danger medium hits: 64 (+60), Burst: 53 req / 2s (+35)
2026-04-13 16:00:06
Last malicious request observed
Total score reached: 263/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Amazon Technologies Inc.
AS16509 · 🇫🇷 France
06

Recommendations

Actions taken & recommended

  • IP 35.180.198.159 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🌊 Traffic Flood Defense

IP 35.180.198.159 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

🔎 Directory Scan Defense

IP 35.180.198.159 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
dnsbl.sorbs.net
✓ Clean
ix.dnsbl.manitu.net
✓ Clean
zen.spamhaus.org
✓ Clean
bl.spamcop.net
✓ Clean
psbl.surriel.com
✓ Clean
b.barracudacentral.org
✓ Clean
truncate.gbudb.net
✓ Clean
dnsbl-1.uceprotect.net

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

35.180.198.159 has been assigned a threat score of 263/100 (Critical). A score this high marks a critical threat actor. This address has demonstrated persistent, aggressive malicious behavior across multiple detection vectors.

The following attack categories were identified:

Request FloodingPath Enumeration

📊 Threat Analysis

Threat intelligence analysis has linked 35.180.198.159 to malicious activity originating from Paris, France, operating on the network of Amazon Technologies Inc.. The address has been under observation since its initial detection. Over a period of 1 days, this IP generated 72 malicious requests, averaging approximately 72 requests per day. Classified as a hosting IP, this address likely runs on a rented server or cloud instance. Attackers prefer datacenter IPs for their high bandwidth and disposable nature. The dual attack vectors of Request Flooding combined with Path Enumeration indicate a coordinated assault rather than opportunistic scanning. At 263/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇫🇷 Top threats from France

35.180.234.238 (263)51.44.11.24 (263)15.188.60.86 (263)35.181.153.137 (263)13.38.117.95 (263)View all →

🏢 Same network: AS16509

15.220.152.241 (320)18.219.106.176 (315)15.220.169.114 (280)108.136.131.13 (265)54.206.58.169 (263)View all →
12

Security Intelligence

💡 Command Injection Techniques

Command injection occurs when attackers insert operating system commands through application inputs. Successful exploitation grants direct server access, enabling data theft, malware installation, and lateral movement across networks.

💡 Content Delivery Network Risks

CDNs can inadvertently mask the true origin of malicious traffic, making attribution difficult. Attackers abuse CDN services to proxy their attacks, leverage cached content for amplification, and exploit misconfigurations in CDN-to-origin connections.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 06:31
Behave or get exposed