Dashboard›🇮🇪 Ireland›40.113.19.56
ABUSE.MOM
THREAT REPORT

IP Threat Report
40.113.19.56

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 13:08:50
First seen: 2026-02-17 17:25:06
Last seen: 2026-03-25 19:00:05
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 88.

UA_SUSDANGER_PATHRATIO_404BURSTREDIRECT_PROBEIMPORT
01

Geolocation & Classification

IP Address
40.113.19.56
Type
Hosting
Country
🇮🇪 Ireland
City
Dublin
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (northeurope)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
88
02

Detection Signatures

SignatureDescriptionPointsSeverity
UA suspicious (short/empty)Behavioral anomaly detected by automated analysis+15
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 30Medium-risk: admin panels, config files+60
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst: 24 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 28 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 45High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 316Medium-risk: admin panels, config files+60
Probe pattern 302->404 same pathBehavioral anomaly detected by automated analysis+20
Burst: 56 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 200 req / 10sAbnormally fast request rate — automated scanning+35
Imported from old blocklistBehavioral anomaly detected by automated analysis+0
Danger strong hits: 136High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 1096Medium-risk: admin panels, config files+60
Burst: 90 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 34High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 368Medium-risk: admin panels, config files+60
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
Burst: 15 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 54 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger medium hits: 1Medium-risk: admin panels, config files+10
Danger strong hits: 50High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 239Medium-risk: admin panels, config files+60
Burst: 55 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 193 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 197 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 67High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 358Medium-risk: admin panels, config files+60
Danger strong hits: 94High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 526Medium-risk: admin panels, config files+60
Burst: 42 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 130 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 108High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 1044Medium-risk: admin panels, config files+60
Burst: 168 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 70High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 522Medium-risk: admin panels, config files+60
Danger strong hits: 36High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 348Medium-risk: admin panels, config files+60
Burst: 37 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 125 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 52High-risk paths: shells, RCE vectors, exploits+100
Burst: 118 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 52 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 184 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 34 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 111 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 53 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 191 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 45 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 153 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 38 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 129 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 46 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 158 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 54High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 490Medium-risk: admin panels, config files+60
Burst: 33 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 47 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 163 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 152 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 347Medium-risk: admin panels, config files+60
Danger medium hits: 342Medium-risk: admin panels, config files+60
Burst: 41 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 370Medium-risk: admin panels, config files+60
Burst: 161 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 57 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 364Medium-risk: admin panels, config files+60
Danger medium hits: 552Medium-risk: admin panels, config files+60
Danger medium hits: 394Medium-risk: admin panels, config files+60
Burst: 35 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 115 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 36 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 123 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 119 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 44 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 132 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 120 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger medium hits: 2Medium-risk: admin panels, config files+20
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 197Medium-risk: admin panels, config files+60
Burst: 31 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 104 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 55High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 404Medium-risk: admin panels, config files+60
Burst: 51 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 176 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 128 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 101 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 402Medium-risk: admin panels, config files+60
Burst: 110 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 21High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 213Medium-risk: admin panels, config files+60
Burst: 105 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 188Medium-risk: admin panels, config files+60
Burst: 103 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 39 req / 2sAbnormally fast request rate — automated scanning+35
Danger strong hits: 74High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 609Medium-risk: admin panels, config files+60
Burst: 121 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 406Medium-risk: admin panels, config files+60
Burst: 134 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 135 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 31High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 124Medium-risk: admin panels, config files+60
Burst: 54 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 124 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 93High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 242Medium-risk: admin panels, config files+60
Danger strong hits: 62High-risk paths: shells, RCE vectors, exploits+100
Burst: 187 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 49 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 164 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 127 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 189 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 190 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 195 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 179 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 173 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 198 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 188 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 172 req / 10sAbnormally fast request rate — automated scanning+35
Σ = 6125
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-02-17 17:25:06
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
UA suspicious (short/empty) (+15), Danger strong hits: 4 (+100), Danger medium hits: 30 (+60)
2026-03-25 19:00:05
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇮🇪 Ireland
06

Recommendations

Actions taken & recommended

  • IP 40.113.19.56 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 User-Agent Anomaly Defense

IP 40.113.19.56 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

🔎 Path Enumeration Protection

Block scanning from 40.113.19.56: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 40.113.19.56.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED
Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

40.113.19.56 has been assigned a threat score of 280/100 (Critical). This places it in the critical threat category. Immediate blocking is strongly advised across all network perimeters.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

Threat intelligence analysis has linked 40.113.19.56 to malicious activity originating from Dublin, Ireland, operating on the network of Microsoft Corporation. The address has been under observation since its initial detection. The address has been active for 36 days in our monitoring system, producing 88 flagged requests at a rate of ~2.4/day. Operating from datacenter infrastructure, this IP is typical of addresses used in organized attack operations. Cloud and VPS providers are commonly exploited as launching platforms for automated scanning. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. Ireland currently accounts for 16 blocked IPs in our database, making it a notable source of malicious traffic. With a threat score of 280/100, this IP is among the most dangerous addresses in our database. Immediate and complete blocking is strongly recommended.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇮🇪 Top threats from Ireland

40.69.27.251 (280)20.166.38.178 (280)40.112.95.11 (280)52.169.119.118 (280)40.69.66.178 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →
12

Security Intelligence

💡 TLS Fingerprinting (JA3/JA4)

TLS fingerprinting creates unique identifiers based on how clients negotiate encrypted connections. The JA3 and JA4 methods generate hashes from TLS ClientHello parameters, enabling identification of specific tools and malware regardless of IP address changes.

💡 File Upload Vulnerabilities

Insecure file upload functionality allows attackers to upload web shells, malware, or scripts that execute on the server. Proper validation must check file content, not just extensions, and uploaded files should be stored outside the web root.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 13:08
Behave or get exposed