Dashboard›🇮🇹 Italy›4.232.89.175

THREAT REPORT

IP Threat Report
4.232.89.175

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 07:14:42

First seen: 2026-02-17 17:25:08

Last seen: 2026-02-24 18:00:05

Geolocation & Classification

IP Address

4.232.89.175

Type

Hosting

Country

🇮🇹 Italy

City

Milan

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (italynorth)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

151

Detection Signatures

Signature	Description	Points
UA suspicious (short/empty)	Behavioral anomaly detected by automated analysis	+15
Danger strong hits: 12	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 63	Medium-risk: admin panels, config files	+60
Burst: 35 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 84 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 9	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 42	Medium-risk: admin panels, config files	+60
Burst: 33 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 63 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 6	High-risk paths: shells, RCE vectors, exploits	+100
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
Probe pattern 302->404 same path	Behavioral anomaly detected by automated analysis	+20
Burst: 37 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 42 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 34 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 60 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 38 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 42 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 30 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 62 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 41 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 31 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 41	Medium-risk: admin panels, config files	+60
Burst: 38 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 25 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 39 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 61 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 69	Medium-risk: admin panels, config files	+60
Burst: 36 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 92 req / 10s	Abnormally fast request rate — automated scanning	+35
Imported from old blocklist	Behavioral anomaly detected by automated analysis	+0
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Danger medium hits: 46	Medium-risk: admin panels, config files	+60
Burst: 32 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 44 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 91 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 40 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 46 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 1	High-risk paths: shells, RCE vectors, exploits	+25
Danger medium hits: 1	Medium-risk: admin panels, config files	+10
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Burst: 68 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 28	Medium-risk: admin panels, config files	+60
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst: 29 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 56	Medium-risk: admin panels, config files	+60
Burst: 86 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 87 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 69 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 66 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 29 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 32	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 368	Medium-risk: admin panels, config files	+60
Burst: 41 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 140 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 58 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 8	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 84	Medium-risk: admin panels, config files	+60
Burst: 43 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 116 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 64	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 553	Medium-risk: admin panels, config files	+60
Burst: 44 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 135 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 52 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 46 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 48 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 115 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 47 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 6	Medium-risk: admin panels, config files	+60
Burst: 8 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 4	Medium-risk: admin panels, config files	+40
Danger strong hits: 16	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 185	Medium-risk: admin panels, config files	+60
Burst: 49 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 173 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 2	Medium-risk: admin panels, config files	+20
Burst: 54 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 55 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 57 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 56 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 53 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 58 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 50 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 45	Medium-risk: admin panels, config files	+60
Burst: 47 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 11	Medium-risk: admin panels, config files	+60
Burst: 11 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 11 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 169 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 6 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 9	Medium-risk: admin panels, config files	+60
Burst: 12 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 12 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 5 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 15	Medium-risk: admin panels, config files	+60
Burst: 20 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 20 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 52	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 326	Medium-risk: admin panels, config files	+60
Burst: 15 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 54 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 54	Medium-risk: admin panels, config files	+60
Danger strong hits: 21	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 81	Medium-risk: admin panels, config files	+60
Burst: 14 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 49 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 28	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 75	Medium-risk: admin panels, config files	+60
Burst: 50 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 81 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 7	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 27	Medium-risk: admin panels, config files	+60
Burst: 27 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 27 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 53 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 48 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 77 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 26 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 24 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 37 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 80 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 45 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 22	Medium-risk: admin panels, config files	+60
Burst: 22 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 22 req / 10s	Abnormally fast request rate — automated scanning	+35

Σ = 5755

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-02-17 17:25:08

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

UA suspicious (short/empty) (+15), Danger strong hits: 12 (+100), Danger medium hits: 63 (+60)

2026-02-24 18:00:05

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇮🇹 Italy

Recommendations

Actions taken & recommended

IP 4.232.89.175 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 4.232.89.175: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 4.232.89.175.

🔎 Directory Scan Defense

IP 4.232.89.175 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED

Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

4.232.89.175 has been assigned a threat score of 280/100 (Critical). A score this high marks a critical threat actor. This address has demonstrated persistent, aggressive malicious behavior across multiple detection vectors.

The following attack categories were identified:

User-Agent AnomalyRequest FloodingPath Enumeration

📊 Threat Analysis

4.232.89.175 is registered in Milan, Italy, operating on the network of Microsoft Corporation. This IP first appeared in our threat feeds after triggering multiple behavioral detection signatures. Over a period of 7 days, this IP generated 151 malicious requests, averaging approximately 21.6 requests per day. This address belongs to a datacenter or cloud hosting provider. Hosting IPs are frequently leveraged by threat actors who rent cheap VPS instances specifically for conducting attacks. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇮🇹 Top threats from Italy

4.232.88.90 (280)172.213.16.18 (280)4.232.90.25 (280)172.213.17.83 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →

Security Intelligence

💡 HTTP Header Analysis for Threat Detection

Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

🔍 Check Any IP Address

Share this report:

IP Threat Report4.232.89.175

⛔ Verdict: BLOCK