Dashboard›🇵🇱 Poland›74.248.34.156
ABUSE.MOM
THREAT REPORT

IP Threat Report
74.248.34.156

ABUSE.MOM — BEHAVE OR GET EXPOSED

Generated: 2026-05-30 08:19:01
First seen: 2026-02-17 17:25:07
Last seen: 2026-02-22 04:00:08
280

⛔ Verdict: BLOCK

This IP address has been classified as a source of malicious automated activity. Threat score: 280/100. Total malicious requests observed: 94.

UA_SUSDANGER_PATHRATIO_404REDIRECT_PROBEBURSTIMPORT
01

Geolocation & Classification

IP Address
74.248.34.156
Type
Hosting
Country
🇵🇱 Poland
City
Warsaw
ISP
Microsoft Corporation
Organization
Microsoft Azure Cloud (polandcentral)
Autonomous System
AS8075 Microsoft Corporation
Hit Count
94
02

Detection Signatures

SignatureDescriptionPointsSeverity
UA suspicious (short/empty)Behavioral anomaly detected by automated analysis+15
Danger strong hits: 4High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 128Medium-risk: admin panels, config files+60
404 ratio 40-60%Majority of requests returned 404 — enumeration+15
Probe pattern 302->404 same pathBehavioral anomaly detected by automated analysis+20
Burst: 52 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 127 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 2High-risk paths: shells, RCE vectors, exploits+50
Danger medium hits: 108Medium-risk: admin panels, config files+60
Burst: 46 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 107 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 8High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 189Medium-risk: admin panels, config files+60
Burst: 43 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 140 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 6High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 126Medium-risk: admin panels, config files+60
Burst: 45 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 148 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 3High-risk paths: shells, RCE vectors, exploits+75
Burst: 37 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 126 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 38 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 125 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 9High-risk paths: shells, RCE vectors, exploits+100
Danger medium hits: 94Medium-risk: admin panels, config files+60
Burst: 32 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 103 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 109 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 162Medium-risk: admin panels, config files+60
Burst: 42 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 138 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 184Medium-risk: admin panels, config files+60
Burst: 36 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 105 req / 10sAbnormally fast request rate — automated scanning+35
Imported from old blocklistBehavioral anomaly detected by automated analysis+0
Danger medium hits: 130Medium-risk: admin panels, config files+60
Burst: 58 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 179 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 130 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 180 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 10Medium-risk: admin panels, config files+60
Burst: 12 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 12 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 15Medium-risk: admin panels, config files+60
Burst: 24 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 24 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 23 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 129 req / 10sAbnormally fast request rate — automated scanning+35
Danger strong hits: 1High-risk paths: shells, RCE vectors, exploits+25
Danger medium hits: 1Medium-risk: admin panels, config files+10
Danger medium hits: 195Medium-risk: admin panels, config files+60
Burst: 48 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 168 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 50 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 53 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 174 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 49 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 171 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 162 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 18 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 17 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 56 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 193 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 110Medium-risk: admin panels, config files+60
Burst: 47 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 110 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 79 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 144 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 135 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 145 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 165Medium-risk: admin panels, config files+60
Burst: 139 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 40 req / 2sAbnormally fast request rate — automated scanning+35
Danger medium hits: 70Medium-risk: admin panels, config files+60
Burst: 70 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 104 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 30 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 59 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 106Medium-risk: admin panels, config files+60
Burst: 106 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 146 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 159Medium-risk: admin panels, config files+60
Burst: 51 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 173 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 216Medium-risk: admin panels, config files+60
Burst: 54 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 182 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 22Medium-risk: admin panels, config files+60
Burst: 31 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 32 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 194Medium-risk: admin panels, config files+60
Burst: 172 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 55 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 167 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 136 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 160 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 324Medium-risk: admin panels, config files+60
Burst: 14 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 51 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 49 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 74Medium-risk: admin panels, config files+60
Burst: 13 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 45 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 41 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 46 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 47 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 62Medium-risk: admin panels, config files+60
Danger medium hits: 12Medium-risk: admin panels, config files+60
Burst: 19 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 44 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 48 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 46Medium-risk: admin panels, config files+60
Danger medium hits: 28Medium-risk: admin panels, config files+60
Burst: 42 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 43 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 15 req / 2sAbnormally fast request rate — automated scanning+35
Burst: 53 req / 10sAbnormally fast request rate — automated scanning+35
Burst: 55 req / 10sAbnormally fast request rate — automated scanning+35
Danger medium hits: 6Medium-risk: admin panels, config files+60
Burst: 9 req / 2sAbnormally fast request rate — automated scanning+35
Σ = 5110
03

Observed Activity

Reconstructed HTTP requests from server access logs. Target domains redacted for security.

[redacted]
GET
/
200
[redacted]
GET
/page
200
Requests shown: 2 · HTTP 404: 0 · Dangerous patterns: 0

* Typical request patterns for detected signatures. Actual target domains are redacted.

04

Timeline

2026-02-17 17:25:07
First malicious request detected
IP entered monitoring from server access logs
During observation
Multiple detection signatures triggered
UA suspicious (short/empty) (+15), Danger strong hits: 4 (+100), Danger medium hits: 128 (+60)
2026-02-22 04:00:08
Last malicious request observed
Total score reached: 280/100
Next cycle
IP blocked — all subsequent requests denied (HTTP 403)
Added to blocklist automatically
05

Network Provider

Microsoft Corporation
AS8075 · 🇵🇱 Poland
06

Recommendations

Actions taken & recommended

  • IP 74.248.34.156 is blocked at application level (HTTP 403)
  • Consider blocking at firewall level (iptables/CSF) to reduce server load
  • Report abuse to the network provider via their abuse contact
  • Ensure sensitive files (.env, .git, backups) are not accessible from the web

🤖 Bot Detection

Address UA spoofing from 74.248.34.156: maintain blocklist of known malicious UA strings, require consistent UA across sessions, implement TLS fingerprinting.

🔎 Path Enumeration Protection

Block scanning from 74.248.34.156: rate-limit 404 responses per IP, deploy a honeypot 404 page, ensure no backup files are web-accessible.

🌊 Traffic Flood Defense

IP 74.248.34.156 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

08

Open Ports & Services

Network reconnaissance data from Shodan. Open ports may indicate running services, misconfigurations, or potential attack surfaces.

OPEN PORTS (1)
PortServiceRiskDescription
3389RDPHighRemote Desktop Protocol — primary target for ransomware attacks

⚠️ Network scanning reveals 1 dangerous service exposed on 74.248.34.156. Exposed RDP (3389) is the #1 entry point for ransomware attacks. These services should not be publicly accessible without strict firewall rules.

Data source: Shodan InternetDB. Scanned independently of abuse.mom.

09

Blacklist Status (DNSBL)

This IP was checked against major DNS-based blacklists used by mail servers and firewalls worldwide.

✓ Clean
Spamhaus ZEN

Checked: Spamhaus, SpamCop, Barracuda, SORBS, CBL, UCEProtect. Results may change over time.

10

Threat Analysis

74.248.34.156 has been assigned a threat score of 280/100 (Critical). With this rating, the IP falls into the critical severity bracket — among the most dangerous addresses in our monitoring database.

The following attack categories were identified:

User-Agent AnomalyPath EnumerationRequest Flooding

📊 Threat Analysis

IP address 74.248.34.156 has been traced to Warsaw, Poland, operating on the network of Microsoft Corporation. Our threat detection systems have flagged this address based on observed malicious behavior patterns. Our sensors captured 94 malicious requests from this address across a 4-day span, reflecting a sustained attack cadence of ~23.5 requests per day. Operating from datacenter infrastructure, this IP is typical of addresses used in organized attack operations. Cloud and VPS providers are commonly exploited as launching platforms for automated scanning. With 3 different attack patterns detected, this IP exhibits behavior characteristic of advanced automated scanning frameworks. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.

This IP belongs to a hosting or data center provider. Malicious traffic from hosting infrastructure often originates from compromised VPS instances, rented servers used for scanning campaigns, or abused free-tier cloud accounts. Hosting providers typically respond to abuse reports within 24-72 hours.

11

Related Threats

🇵🇱 Top threats from Poland

74.248.132.176 (280)74.248.96.218 (280)20.215.67.86 (280)View all →

🏢 Same network: AS8075

74.241.249.229 (340)20.151.111.128 (308)4.182.24.88 (285)20.65.61.3 (283)4.205.39.97 (283)View all →
12

Security Intelligence

💡 HTTP Header Analysis for Threat Detection

Examining HTTP headers beyond User-Agent reveals attack tools and automated scripts. Missing standard headers, unusual ordering, non-standard values, and inconsistencies with claimed client identity all serve as reliable detection signals.

💡 GDPR and Threat Intelligence

Processing IP addresses for security purposes under GDPR requires balancing legitimate interest in network protection with data minimization principles. Threat intelligence platforms must implement appropriate retention policies and provide mechanisms for data subject rights.

🔍 Check Any IP Address

Share this report:
AboutDisclaimerTermsAbuse Reports Tracker
Report generated 30.05.2026 08:19
Behave or get exposed