Dashboard›🇮🇪 Ireland›52.169.206.229

THREAT REPORT

IP Threat Report
52.169.206.229

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 07:14:42

First seen: 2026-02-17 17:25:08

Last seen: 2026-05-07 19:00:06

Geolocation & Classification

IP Address

52.169.206.229

Type

Hosting

Country

🇮🇪 Ireland

City

Dublin

ISP

Microsoft Corporation

Organization

Microsoft Azure Cloud (northeurope)

Autonomous System

AS8075 Microsoft Corporation

Hit Count

215

Detection Signatures

Signature	Description	Points
UA suspicious (short/empty)	Behavioral anomaly detected by automated analysis	+15
Danger strong hits: 17	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 184	Medium-risk: admin panels, config files	+60
404 ratio >= 60%	Majority of requests returned 404 — enumeration	+25
Burst: 53 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 113 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 64	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 732	Medium-risk: admin panels, config files	+60
404 ratio 40-60%	Majority of requests returned 404 — enumeration	+15
Probe pattern 302->404 same path	Behavioral anomaly detected by automated analysis	+20
Burst: 54 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 196 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 45	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 316	Medium-risk: admin panels, config files	+60
Burst: 197 req / 10s	Abnormally fast request rate — automated scanning	+35
Imported from old blocklist	Behavioral anomaly detected by automated analysis	+0
Danger strong hits: 1	High-risk paths: shells, RCE vectors, exploits	+25
Danger medium hits: 1	Medium-risk: admin panels, config files	+10
Danger strong hits: 34	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 366	Medium-risk: admin panels, config files	+60
Burst: 15 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 42	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 364	Medium-risk: admin panels, config files	+60
Burst: 36 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 105 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 53	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 239	Medium-risk: admin panels, config files	+60
Burst: 191 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 36	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 238	Medium-risk: admin panels, config files	+60
Burst: 160 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 71	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 358	Medium-risk: admin panels, config files	+60
Burst: 190 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 181 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 51 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 185 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 178 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 367	Medium-risk: admin panels, config files	+60
Burst: 184 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 245	Medium-risk: admin panels, config files	+60
Burst: 46 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 50 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 167 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 50	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 35 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 116 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 33 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 40 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 136 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 42 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 137 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 192 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 183 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 55 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 198 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 526	Medium-risk: admin panels, config files	+60
Danger strong hits: 94	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 528	Medium-risk: admin panels, config files	+60
Danger strong hits: 52	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 348	Medium-risk: admin panels, config files	+60
Burst: 45 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 139 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 128 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 38 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 121 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 70	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 522	Medium-risk: admin panels, config files	+60
Burst: 39 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 122 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 47 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 158 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 370	Medium-risk: admin panels, config files	+60
Burst: 37 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 126 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 44 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 152 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 18	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 185	Medium-risk: admin panels, config files	+60
Burst: 48 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 155 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 54	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 521	Medium-risk: admin panels, config files	+60
Burst: 154 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 41 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 140 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 157 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 546	Medium-risk: admin panels, config files	+60
Burst: 172 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 166 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 135 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 31 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 124 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 156 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 368	Medium-risk: admin panels, config files	+60
Burst: 199 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 552	Medium-risk: admin panels, config files	+60
Burst: 195 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 394	Medium-risk: admin panels, config files	+60
Burst: 52 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 182 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 162 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 402	Medium-risk: admin panels, config files	+60
Burst: 114 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 34 req / 2s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 591	Medium-risk: admin panels, config files	+60
Burst: 132 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 55	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 406	Medium-risk: admin panels, config files	+60
Burst: 110 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 146 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 124	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 56 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 200 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 93	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 242	Medium-risk: admin panels, config files	+60
Burst: 57 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 49 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 125 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 171 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 129 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 62	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 151 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 161 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 43 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 142 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 145 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 270	Medium-risk: admin panels, config files	+60
Danger strong hits: 4	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 608	Medium-risk: admin panels, config files	+60
Burst: 109 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 359	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 186 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 194 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 40	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 326	Medium-risk: admin panels, config files	+60
Danger strong hits: 28	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 189 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 37	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 321	Medium-risk: admin panels, config files	+60
Burst: 119 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 58	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 357	Medium-risk: admin panels, config files	+60
Danger medium hits: 314	Medium-risk: admin panels, config files	+60
Danger strong hits: 26	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 163 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 489	Medium-risk: admin panels, config files	+60
Burst: 130 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 144 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 138 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 147 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 127 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 177 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 164 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 322	Medium-risk: admin panels, config files	+60
Burst: 32 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 112 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 320	Medium-risk: admin panels, config files	+60
Burst: 176 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 6	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 134	Medium-risk: admin panels, config files	+60
Danger strong hits: 31	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 188	Medium-risk: admin panels, config files	+60
Danger strong hits: 69	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 488	Medium-risk: admin panels, config files	+60
Burst: 193 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 48	High-risk paths: shells, RCE vectors, exploits	+100
Danger strong hits: 65	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 482	Medium-risk: admin panels, config files	+60
Danger medium hits: 498	Medium-risk: admin panels, config files	+60
Danger strong hits: 51	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 331	Medium-risk: admin panels, config files	+60
Burst: 141 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 351	Medium-risk: admin panels, config files	+60
Burst: 188 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 68	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 527	Medium-risk: admin panels, config files	+60
Burst: 169 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 179 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 336	Medium-risk: admin panels, config files	+60
Burst: 175 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 335	Medium-risk: admin panels, config files	+60
Burst: 117 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 74	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 668	Medium-risk: admin panels, config files	+60
Danger medium hits: 327	Medium-risk: admin panels, config files	+60
Burst: 153 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 307	Medium-risk: admin panels, config files	+60
Burst: 187 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 49	High-risk paths: shells, RCE vectors, exploits	+100
Burst: 174 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 67	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 461	Medium-risk: admin panels, config files	+60
Danger medium hits: 315	Medium-risk: admin panels, config files	+60
Burst: 95 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 143 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 2	High-risk paths: shells, RCE vectors, exploits	+50
Danger medium hits: 2	Medium-risk: admin panels, config files	+20
Danger medium hits: 313	Medium-risk: admin panels, config files	+60
Danger medium hits: 470	Medium-risk: admin panels, config files	+60
Burst: 168 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 318	Medium-risk: admin panels, config files	+60
Burst: 173 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger strong hits: 76	High-risk paths: shells, RCE vectors, exploits	+100
Danger medium hits: 481	Medium-risk: admin panels, config files	+60
Burst: 170 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 324	Medium-risk: admin panels, config files	+60
Danger medium hits: 487	Medium-risk: admin panels, config files	+60
Danger strong hits: 3	High-risk paths: shells, RCE vectors, exploits	+75
Danger medium hits: 16	Medium-risk: admin panels, config files	+60
Burst: 23 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 24 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 24 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 16 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 16 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 20	Medium-risk: admin panels, config files	+60
Burst: 30 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 30 req / 10s	Abnormally fast request rate — automated scanning	+35
Burst: 20 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 20 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 10	Medium-risk: admin panels, config files	+60
Burst: 10 req / 2s	Abnormally fast request rate — automated scanning	+35
Burst: 10 req / 10s	Abnormally fast request rate — automated scanning	+35
Danger medium hits: 22	Medium-risk: admin panels, config files	+60
Burst: 33 req / 10s	Abnormally fast request rate — automated scanning	+35

Σ = 11630

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]

GET

200

[redacted]

GET

/page

200

Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

Timeline

2026-02-17 17:25:08

First malicious request detected

IP entered monitoring from server access logs

During observation

Multiple detection signatures triggered

UA suspicious (short/empty) (+15), Danger strong hits: 17 (+100), Danger medium hits: 184 (+60)

2026-05-07 19:00:06

Last malicious request observed

Total score reached: 280/100

Next cycle

IP blocked — all subsequent requests denied (HTTP 403)

Added to blocklist automatically

Network Provider

Microsoft Corporation

AS8075 · 🇮🇪 Ireland

Recommendations

Actions taken & recommended

IP 52.169.206.229 is blocked at application level (HTTP 403)
Consider blocking at firewall level (iptables/CSF) to reduce server load
Report abuse to the network provider via their abuse contact
Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 User-Agent Anomaly Defense

IP 52.169.206.229 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

🔎 Path Enumeration Protection

Block scanning from 52.169.206.229: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Traffic Flood Defense

IP 52.169.206.229 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

⛔ LISTED

Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

Threat Analysis

52.169.206.229 has been assigned a threat score of 280/100 (Critical). A score this high marks a critical threat actor. This address has demonstrated persistent, aggressive malicious behavior across multiple detection vectors.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

The address 52.169.206.229 originates from Dublin, Ireland, operating on the network of Microsoft Corporation. It was identified through automated analysis of incoming network traffic across monitored endpoints. Our sensors captured 215 malicious requests from this address across a 79-day span, reflecting a sustained attack cadence of ~2.7 requests per day. The IP is classified as hosting/datacenter infrastructure, commonly associated with rented servers used for automated attack campaigns, botnet command-and-control, or vulnerability scanning at scale. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. Our records show 16 malicious IPs originating from Ireland, positioning it as a notable contributor to global threat activity. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

Related Threats

🇮🇪 Top threats from Ireland

40.69.27.251 (280)20.166.38.178 (280)40.113.19.56 (280)40.112.95.11 (280)52.169.119.118 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →

Security Intelligence

💡 HTTP Header Analysis for Threat Detection

Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.

💡 Initial Access Broker Marketplace

Initial access brokers specialize in gaining entry to corporate networks and selling that access to ransomware operators. This specialization creates an efficient criminal marketplace where compromised credentials and VPN access are traded as commodities.

🔍 Check Any IP Address

Share this report:

IP Threat Report52.169.206.229

⛔ Verdict: BLOCK