# 104.234.53.29 — IP Intelligence Summary 104.234.53.29 is an IPv4 address operated by Internet Utilities NA LLC (AS206092), geolocated to Toronto, Canada. As of October 7, 2026, IPDebrief rates it Moderate Risk (60/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.234.53.29 - Last updated: 2026-10-07 ## Ownership - Organization: Internet Utilities NA LLC - Network name: NETUTILS - Allocated block: 104.234.0.0/17 - ASN: AS206092 (https://ipdebrief.com/asn/206092) - Regional registry: ARIN ## Location - City: Toronto - Region: ON - Country: Canada - Time zone: America/Toronto ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (60/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP INTELLIGENCE BRIEFING: 104.234.53.29 **Classification:** Moderate Risk (Score: 60/100) **Reporting Date:** Current Analysis **Prepared For:** SOC Operations \--- \## EXECUTIVE SUMMARY IP 104.234.53.29 is classified as a **Moderate Risk** address with a reputation score of 60/100. The IP is assigned to Internet Utilities NA LLC (AS206092) under the NETUTILS network block (104.234.0.0/17). Geolocation data indicates placement in Canada (New York region). The address shows minimal active threat indicators but has been flagged by honeypot systems and carries a single DNSBL listing. \--- \## OWNERSHIP & INFRASTRUCTURE | Field | Value | |-------|-------| | **ASN** | 206092 | | **Organization** | Internet Utilities NA LLC | | **Netname** | NETUTILS | | **CIDR Block** | 104.234.0.0/17 | | **RIR** | ARIN | | **Registration** | Via RDAP | | **Geolocation** | Canada (CA) - New York | | **Accuracy** | 3000 km radius | **Network Role Classification:** Firewalled / No Services **Service Status:** No active services detected (ports closed or non-existent) \--- \## THREAT INDICATORS | Indicator | Status | |-----------|--------| | **Risk Score** | 60 (Moderate) | | **Abuse Confidence** | Not assessed | | **Tor Exit Node** | No | | **Known Attacker** | No | | **Spam Source** | No | | **Blacklist Count** | 0 threat feeds | | **DNSBL Listed** | 1 of 8 lists | | **Honeypot Hits** | 1 | | **Total Incidents** | 1 | | **Campaign Likelihood** | Not assessed | **Threat Feeds:** No active threat feed matches **Known Campaigns:** None identified \--- \## NETWORK NEIGHBORHOOD ANALYSIS **Subnet:** 104.234.53.0/24 **Total Siblings:** 91 **Abuse Density:** 0.0978 (Low) **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 5 \- Low Risk: 79 **Sample Neighbor Risk Scores:** \- 104.234.53.11: 25 \- 104.234.53.12: 25 \- 104.234.53.14: 25 \- 104.234.53.15: 20 \- 104.234.53.16: 25 The /24 subnet demonstrates low abuse density with the majority of sibling IPs classified as low-risk. No high-risk neighbors identified. \--- \## OBSERVATION HISTORY **Total Observations:** 16 signals tracked **Recent Classification:** mostly_clean **Inherited Risk:** 3 (Low) **Threat Persistence:** 0 days **Ownership Changes:** 0 **Recent Signal Timeline (July 18, 2026):** \- 11:02 UTC: Subnet classification "mostly_clean" with 92 total siblings \- 09:11 UTC: Network role assessment - no CDN, Tor, VPN, cloud, or proxy services \- 09:07 UTC: Ownership attribution to Internet Utilities NA LLC (ARIN) \- 09:07 UTC: Geolocation - Canada with 35% confidence No persistent malicious behavior detected. \--- \## NETWORK TOPOLOGY **Control Plane:** \- **Origin ASN:** 206092 \- **BGP Prefix:** 104.234.53.0/24 \- **Route Stability:** False \- **Route Changes (30d):** 0 \- **DNSSEC Valid:** Yes \- **RPKI State:** Not assessed **Traceroute Summary:** \- **Hop Count:** 11 \- **Transit Networks:** Comcast \- **Timed Out Hops:** 2 \--- \## RECOMMENDED ACTIONS **Primary Recommendation:** Increase logging verbosity and review recent activity from this IP **Severity:** High **Rationale:** Elevated risk score (60/100) warrants enhanced monitoring **Firewall Implementation Rules:** \`\`\`bash \# iptables iptables -A INPUT -s 104.234.53.29 -j DROP \# nftables nft add rule inet filter input ip saddr 104.234.53.29 drop \# nginx deny 104.234.53.29; \# pfSense 104.234.53.29/32 \# Cloudflare WAF { "description": "Block 104.234.53.29 — IPDebrief risk score 60", "action": "block", "filter": { "expression": "ip.src eq 104.234.53.29" } } \# AWS WAF { "Addresses": \["104.234.53.29/32"\], "Description": "IPDebrief risk 60" } \`\`\` \--- \## ANALYST NOTES 1. **Risk Context:** The IP carries a moderate risk score (60) primarily due to honeypot detection and a single DNSBL listing. No active threat campaigns or known attacker patterns identified. 2. **Neighborhood Risk:** The /24 subnet shows low abuse density (0.0978) with 79 low-risk neighbors. The IP does not appear to be part of a coordinated malicious cluster. 3. **Service Profile:** No open ports or active services detected, suggesting the IP is either dormant, firewalled, or used for infrastructure purposes. 4. **Operational Recommendation:** Monitor for activity patterns. Given the honeypot hit history, investigate any inbound connection attempts or outbound traffic from this address. \--- **End of Briefing** ## Nearby addresses - 104.234.53.1 (https://ipdebrief.com/104.234.53.1) - 104.234.53.2 (https://ipdebrief.com/104.234.53.2) - 104.234.53.3 (https://ipdebrief.com/104.234.53.3) - 104.234.53.4 (https://ipdebrief.com/104.234.53.4) - 104.234.53.5 (https://ipdebrief.com/104.234.53.5) - 104.234.53.6 (https://ipdebrief.com/104.234.53.6) - 104.234.53.10 (https://ipdebrief.com/104.234.53.10) - 104.234.53.11 (https://ipdebrief.com/104.234.53.11) - 104.234.53.12 (https://ipdebrief.com/104.234.53.12) - 104.234.53.13 (https://ipdebrief.com/104.234.53.13) - 104.234.53.14 (https://ipdebrief.com/104.234.53.14) - 104.234.53.15 (https://ipdebrief.com/104.234.53.15) --- Source: IPDebrief, "104.234.53.29 IP intelligence", https://ipdebrief.com/104.234.53.29, updated 2026-10-07. Assessments are probabilistic.