104.244.75.190📋 Copy

# IP INTELLIGENCE BRIEFING: 104.244.75.190/32

Classification: Low Risk / Infrastructure Hosting

Date: Current Intelligence Cycle

Analyst: IPDebrief SOC Intelligence

---

## EXECUTIVE SUMMARY

IP address 104.244.75.190 is registered to BuyVM (ASN 53667, PONYNET - FranTech Solutions) and operates within the 104.244.72.0/21 BGP prefix. The IP carries a low overall risk score of 25 with no active threat indicators. However, the IP operates within a subnet showing moderate abuse density (33.33%), with two neighboring addresses exhibiting medium-risk profiles. The target system is currently firewalled with no open ports or services.

---

## NETWORK ATTRIBUTES & OWNERSHIP

---

## THREAT ASSESSMENT

Current Risk Profile:

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Indicators:

• Operator Score: 0.1304 (Minimal)
• Route Stability: False (routing changes detected)
• DNSBL Listings: 1 of 8 total lists
• RPKI State: Not validated

Service Exposure:

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• DNS PTR Records: None
• Status: Firewalled / No Services

---

## SUBNET CONTEXT (104.244.75.0/24)

Neighborhood Analysis:

• Total Sibling IPs: 3
• Active Siblings: 3
• Threat Siblings: 1
• Abuse Density: 33.33%
• Subnet Classification: mostly_clean

Neighbor Risk Distribution:

---

## OBSERVATION HISTORY

Recent Signal Activity:

• Total Observations: 21 signals tracked
• Latest Observation: 2026-06-25 21:59:55 UTC
• Observation Types: Network classification, geolocation, subnet abuse density, ASN routing

Historical Trends:

• ASN 53667 routing signals consistent since 2026-06-19
• Infrastructure classification identified as ColocationHosting
• No persistent malicious behavior observed
• No ownership changes detected

---

## RELATIONSHIP GRAPH

Primary Associations:

• 46 relationship links identified
• Primary association: BUYVM-LUXEMBOURG-01 network infrastructure
• No cross-organizational relationships detected
• No certificate or hostname associations

---

## RECOMMENDED ACTIONS

Firewall/Security Recommendations:

• No immediate blocking action required based on current risk profile
• Monitoring recommended due to subnet abuse density (33.33%)
• Neighbor IPs 104.244.75.74 and 104.244.75.140 should be monitored for coordinated activity

Threat Hunting Indicators:

• Investigate any incoming traffic from this subnet during high-risk periods
• Monitor for DNS queries to known malicious domains from this IP
• Review logs for any connection attempts during off-hours

---

## ANALYST NOTES

This IP represents a cloud/colocation hosting infrastructure endpoint with no current malicious indicators. The low risk score and absence of threat indicators suggest benign operation. However, the moderate abuse density within the /24 subnet warrants awareness. No specific firewall rules are recommended at this time, but continued monitoring is advised given the neighborhood context.

---

Data Sources: IPDebrief Intelligence Platform

Confidence Level: High

Last Updated: 2026-06-25

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.