Dashboard›🇮🇹 Italy›72.146.2.52
ABUSE.MOM
THREAT REPORT

IP Threat Report
72.146.2.52

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-09-04 05:05:33
First seen: 2026-08-13 17:24:36
Last seen: 2026-08-23 02:07:06
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 6697.

BURSTDANGER_PATHRATIO_404REDIRECT_PROBEUA_SUS
01

Geolocation & Classification

IP Address
72.146.2.52
Type
Hosting
Country
🇮🇹 Italy
City
Milan
ISP
BellSouth.net Inc.
Organization
Microsoft Azure Cloud (italynorth)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
6697
02

Detection Signatures

SignatureDescriptionPointsSeverity
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
404 ratio >= 60%Majority of requests returned 404 — enumeration+25
Burst 105/10sAbnormally fast request rate — automated scanning+35
Burst 106/10sAbnormally fast request rate — automated scanning+35
Burst 109/10sAbnormally fast request rate — automated scanning+35
Burst 110/10sAbnormally fast request rate — automated scanning+35
Burst 111/10sAbnormally fast request rate — automated scanning+35
Burst 112/10sAbnormally fast request rate — automated scanning+35
Burst 116/10sAbnormally fast request rate — automated scanning+35
Burst 117/10sAbnormally fast request rate — automated scanning+35
Burst 119/10sAbnormally fast request rate — automated scanning+35
Burst 121/10sAbnormally fast request rate — automated scanning+35
Burst 122/10sAbnormally fast request rate — automated scanning+35
Burst 123/10sAbnormally fast request rate — automated scanning+35
Burst 124/10sAbnormally fast request rate — automated scanning+35
Burst 126/10sAbnormally fast request rate — automated scanning+35
Burst 131/10sAbnormally fast request rate — automated scanning+35
Burst 133/10sAbnormally fast request rate — automated scanning+35
Burst 14/2sAbnormally fast request rate — automated scanning+35
Burst 140/10sAbnormally fast request rate — automated scanning+35
Burst 141/10sAbnormally fast request rate — automated scanning+35
Burst 144/10sAbnormally fast request rate — automated scanning+35
Burst 150/10sAbnormally fast request rate — automated scanning+35
Burst 154/10sAbnormally fast request rate — automated scanning+35
Burst 17/2sAbnormally fast request rate — automated scanning+35
Burst 179/10sAbnormally fast request rate — automated scanning+35
Burst 22/2sAbnormally fast request rate — automated scanning+35
Burst 29/2sAbnormally fast request rate — automated scanning+35
Burst 30/2sAbnormally fast request rate — automated scanning+35
Burst 31/2sAbnormally fast request rate — automated scanning+35
Burst 32/2sAbnormally fast request rate — automated scanning+35
Burst 33/2sAbnormally fast request rate — automated scanning+35
Burst 34/2sAbnormally fast request rate — automated scanning+35
Burst 35/10sAbnormally fast request rate — automated scanning+35
Burst 35/2sAbnormally fast request rate — automated scanning+35
Burst 36/10sAbnormally fast request rate — automated scanning+35
Burst 36/2sAbnormally fast request rate — automated scanning+35
Burst 37/2sAbnormally fast request rate — automated scanning+35
Burst 38/2sAbnormally fast request rate — automated scanning+35
Burst 39/2sAbnormally fast request rate — automated scanning+35
Burst 40/2sAbnormally fast request rate — automated scanning+35
Burst 41/2sAbnormally fast request rate — automated scanning+35
Burst 42/2sAbnormally fast request rate — automated scanning+35
Burst 43/2sAbnormally fast request rate — automated scanning+35
Burst 44/10sAbnormally fast request rate — automated scanning+35
Burst 44/2sAbnormally fast request rate — automated scanning+35
Burst 45/2sAbnormally fast request rate — automated scanning+35
Burst 46/2sAbnormally fast request rate — automated scanning+35
Burst 47/2sAbnormally fast request rate — automated scanning+35
Burst 48/2sAbnormally fast request rate — automated scanning+35
Burst 49/2sAbnormally fast request rate — automated scanning+35
Burst 50/2sAbnormally fast request rate — automated scanning+35
Burst 51/2sAbnormally fast request rate — automated scanning+35
Burst 53/2sAbnormally fast request rate — automated scanning+35
Burst 54/10sAbnormally fast request rate — automated scanning+35
Burst 54/2sAbnormally fast request rate — automated scanning+35
Burst 55/10sAbnormally fast request rate — automated scanning+35
Burst 59/2sAbnormally fast request rate — automated scanning+35
Burst 62/10sAbnormally fast request rate — automated scanning+35
Burst 64/10sAbnormally fast request rate — automated scanning+35
Burst 65/10sAbnormally fast request rate — automated scanning+35
Burst 66/10sAbnormally fast request rate — automated scanning+35
Burst 70/10sAbnormally fast request rate — automated scanning+35
Burst 72/10sAbnormally fast request rate — automated scanning+35
Burst 74/10sAbnormally fast request rate — automated scanning+35
Burst 78/10sAbnormally fast request rate — automated scanning+35
Burst 83/10sAbnormally fast request rate — automated scanning+35
Burst 86/10sAbnormally fast request rate — automated scanning+35
Burst 87/10sAbnormally fast request rate — automated scanning+35
Burst 90/10sAbnormally fast request rate — automated scanning+35
Burst 91/10sAbnormally fast request rate — automated scanning+35
Burst 92/10sAbnormally fast request rate — automated scanning+35
Burst 93/10sAbnormally fast request rate — automated scanning+35
Burst 94/10sAbnormally fast request rate — automated scanning+35
Burst 95/10sAbnormally fast request rate — automated scanning+35
Burst 96/10sAbnormally fast request rate — automated scanning+35
Burst 98/10sAbnormally fast request rate — automated scanning+35
Burst 99/10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 1Medium-risk: admin panels, config files+10
Danger medium hits: 101Medium-risk: admin panels, config files+60
Danger medium hits: 108Medium-risk: admin panels, config files+60
Danger medium hits: 117Medium-risk: admin panels, config files+60
Danger medium hits: 118Medium-risk: admin panels, config files+60
Danger medium hits: 120Medium-risk: admin panels, config files+60
Danger medium hits: 126Medium-risk: admin panels, config files+60
Danger medium hits: 132Medium-risk: admin panels, config files+60
Danger medium hits: 139Medium-risk: admin panels, config files+60
Danger medium hits: 141Medium-risk: admin panels, config files+60
Danger medium hits: 152Medium-risk: admin panels, config files+60
Danger medium hits: 153Medium-risk: admin panels, config files+60
Danger medium hits: 156Medium-risk: admin panels, config files+60
Danger medium hits: 172Medium-risk: admin panels, config files+60
Danger medium hits: 177Medium-risk: admin panels, config files+60
Danger medium hits: 180Medium-risk: admin panels, config files+60
Danger medium hits: 184Medium-risk: admin panels, config files+60
Danger medium hits: 188Medium-risk: admin panels, config files+60
Danger medium hits: 273Medium-risk: admin panels, config files+60
Danger medium hits: 345Medium-risk: admin panels, config files+60
Danger medium hits: 4Medium-risk: admin panels, config files+40
Danger medium hits: 44Medium-risk: admin panels, config files+60
Danger medium hits: 55Medium-risk: admin panels, config files+60
Danger medium hits: 57Medium-risk: admin panels, config files+60
Danger medium hits: 58Medium-risk: admin panels, config files+60
Danger medium hits: 60Medium-risk: admin panels, config files+60
Danger medium hits: 62Medium-risk: admin panels, config files+60
Danger medium hits: 64Medium-risk: admin panels, config files+60
Danger medium hits: 66Medium-risk: admin panels, config files+60
Danger medium hits: 70Medium-risk: admin panels, config files+60
Danger medium hits: 72Medium-risk: admin panels, config files+60
Danger medium hits: 77Medium-risk: admin panels, config files+60
Danger medium hits: 78Medium-risk: admin panels, config files+60
Danger medium hits: 87Medium-risk: admin panels, config files+60
Danger medium hits: 92Medium-risk: admin panels, config files+60
Danger medium hits: 93Medium-risk: admin panels, config files+60
Danger medium hits: 94Medium-risk: admin panels, config files+60
Danger medium hits: 97Medium-risk: admin panels, config files+60
Danger medium hits: 99Medium-risk: admin panels, config files+60
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger strong hits: 12High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 14High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 15High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 18High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger strong hits: 21High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 24High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 49High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 5High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 7High-risk paths: shells, RCE vectors, exploits+100
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Probe 302→404Behavioral anomaly detected by automated analysis+20
UA suspiciousBehavioral anomaly detected by automated analysis+15
Σ = 6355
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-08-13 17:24:36
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
404 ratio 40-60% (+15), 404 ratio >= 60% (+25), Burst 105/10s (+35)
2026-08-23 02:07:06
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

BellSouth.net Inc.
AS8075 · 🇮🇹 Italy
06

Recommendations

Actions taken & recommended

  • IP 72.146.2.52 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Other malicious IPs detected in the same /24 subnet — consider blocking 72.146.2.0/24
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🔎 Directory Scan Defense

IP 72.146.2.52 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

🌊 Flood / DDoS Mitigation

Implement limit_req_zone in nginx. Deploy CDN with DDoS protection. Configure SYN cookies and connection tracking to throttle 72.146.2.52.

🤖 User-Agent Anomaly Defense

IP 72.146.2.52 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

07

Neighbors in 72.146.2.0/24

Other blocked IPs from the same /24 subnet — indicates systematic abuse from this network range.

72.146.2.133
Score: 280 · Hits: 547
72.146.2.255
Score: 280 · Hits: 4
72.146.2.223
Score: 280 · Hits: 2
72.146.2.23
Score: 245 · Hits: 1
09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
zen.spamhaus.org
✓ Clean
b.barracudacentral.org
✓ Clean
bl.blocklist.de
✓ Clean
spam.dnsbl.sorbs.net
✓ Clean
cbl.abuseat.org
✓ Clean
psbl.surriel.com
✓ Clean
dnsbl.dronebl.org

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

72.146.2.52 has been assigned a threat score of 280/100 (Critical). A score this high marks a critical threat actor. This address has demonstrated persistent, aggressive malicious behavior across multiple detection vectors.

The following attack categories were identified:

Path EnumerationRequest FloodingUser-Agent Anomaly

📊 Threat Analysis

The address 72.146.2.52 originates from Milan, Italy, operating on the network of BellSouth.net Inc.. It was identified through automated analysis of incoming network traffic across monitored endpoints. Over a period of 9 days, this IP generated 6,697 malicious requests, averaging approximately 744.1 requests per day. The IP is classified as hosting/datacenter infrastructure, commonly associated with rented servers used for automated attack campaigns, botnet command-and-control, or vulnerability scanning at scale. The diversity of 3 separate attack methods suggests a comprehensive attack toolkit — likely an automated scanner that tests for vulnerabilities across multiple categories. Our records show 112 malicious IPs originating from Italy, positioning it as a significant contributor to global threat activity. A score of 280/100 places this address in the top tier of severity. Block and investigate any historical connections.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇮🇹 Top threats from Italy

152.89.168.29 (330)34.17.191.22 (320)141.11.36.94 (305)2.57.170.183 (305)2.57.170.88 (305)View all →

🏢 Same network: AS8075

68.155.155.199 (320)20.127.136.245 (318)20.151.200.44 (315)72.146.2.133 (280)72.146.44.117 (280)View all →
12

Security Intelligence

💡 DDoS Mitigation Approaches

Distributed denial of service attacks overwhelm infrastructure with traffic volume. Effective mitigation combines always-on traffic scrubbing, anycast network distribution, rate limiting, and the ability to quickly scale absorption capacity during attacks.

💡 Backup and Recovery Against Ransomware

Immutable, offline backups remain the most effective defense against ransomware. The 3-2-1 rule — three copies on two media types with one offsite — combined with regular recovery testing ensures business continuity after encryption attacks.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 04.09.2026 05:05
Behave or get exposed