104.234.53.29📋 Copy

# IP INTELLIGENCE BRIEFING: 104.234.53.29

Classification: Moderate Risk (Score: 60/100)

Reporting Date: Current Analysis

Prepared For: SOC Operations

---

## EXECUTIVE SUMMARY

IP 104.234.53.29 is classified as a Moderate Risk address with a reputation score of 60/100. The IP is assigned to Internet Utilities NA LLC (AS206092) under the NETUTILS network block (104.234.0.0/17). Geolocation data indicates placement in Canada (New York region). The address shows minimal active threat indicators but has been flagged by honeypot systems and carries a single DNSBL listing.

---

## OWNERSHIP & INFRASTRUCTURE

Network Role Classification: Firewalled / No Services

Service Status: No active services detected (ports closed or non-existent)

---

## THREAT INDICATORS

Threat Feeds: No active threat feed matches

Known Campaigns: None identified

---

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 104.234.53.0/24

Total Siblings: 91

Abuse Density: 0.0978 (Low)

Risk Distribution:

• High Risk: 0
• Medium Risk: 5
• Low Risk: 79

Sample Neighbor Risk Scores:

• 104.234.53.11: 25
• 104.234.53.12: 25
• 104.234.53.14: 25
• 104.234.53.15: 20
• 104.234.53.16: 25

The /24 subnet demonstrates low abuse density with the majority of sibling IPs classified as low-risk. No high-risk neighbors identified.

---

## OBSERVATION HISTORY

Total Observations: 16 signals tracked

Recent Classification: mostly_clean

Inherited Risk: 3 (Low)

Threat Persistence: 0 days

Ownership Changes: 0

Recent Signal Timeline (July 18, 2026):

• 11:02 UTC: Subnet classification "mostly_clean" with 92 total siblings
• 09:11 UTC: Network role assessment - no CDN, Tor, VPN, cloud, or proxy services
• 09:07 UTC: Ownership attribution to Internet Utilities NA LLC (ARIN)
• 09:07 UTC: Geolocation - Canada with 35% confidence

No persistent malicious behavior detected.

---

## NETWORK TOPOLOGY

Control Plane:

• Origin ASN: 206092
• BGP Prefix: 104.234.53.0/24
• Route Stability: False
• Route Changes (30d): 0
• DNSSEC Valid: Yes
• RPKI State: Not assessed

Traceroute Summary:

• Hop Count: 11
• Transit Networks: Comcast
• Timed Out Hops: 2

---

## RECOMMENDED ACTIONS

Primary Recommendation: Increase logging verbosity and review recent activity from this IP

Severity: High

Rationale: Elevated risk score (60/100) warrants enhanced monitoring

Firewall Implementation Rules:

```bash

# iptables

iptables -A INPUT -s 104.234.53.29 -j DROP

# nftables

nft add rule inet filter input ip saddr 104.234.53.29 drop

# nginx

deny 104.234.53.29;

# pfSense

104.234.53.29/32

# Cloudflare WAF

{

"description": "Block 104.234.53.29 — IPDebrief risk score 60",

"action": "block",

"filter": {

"expression": "ip.src eq 104.234.53.29"

}

}

# AWS WAF

{

"Addresses": ["104.234.53.29/32"],

"Description": "IPDebrief risk 60"

}

```

---

## ANALYST NOTES

1. Risk Context: The IP carries a moderate risk score (60) primarily due to honeypot detection and a single DNSBL listing. No active threat campaigns or known attacker patterns identified.

2. Neighborhood Risk: The /24 subnet shows low abuse density (0.0978) with 79 low-risk neighbors. The IP does not appear to be part of a coordinated malicious cluster.

3. Service Profile: No open ports or active services detected, suggesting the IP is either dormant, firewalled, or used for infrastructure purposes.

4. Operational Recommendation: Monitor for activity patterns. Given the honeypot hit history, investigate any inbound connection attempts or outbound traffic from this address.

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.