104.251.181.106
# IP Intelligence Briefing: 104.251.181.106/32
Classification: Low Risk / Passive Infrastructure
Date: 2026-07-30
Report Type: Single IP Analysis
---
## Executive Summary
IP 104.251.181.106 presents as a low-risk, passive network asset with no active services detected. The address is geolocated to Zurich, Switzerland, associated with BGP prefix 104.251.180.0/22 (ASN 402253). Despite appearing on 1 of 8 DNSBL lists, the overall risk score remains at 25. No malicious activity, campaigns, or persistent threats observed.
---
## Technical Profile
| Attribute | Value |
|---|---|
| **Risk Score** | 25 (Low Risk) |
| **Reputation** | Low Risk |
| **Country** | Switzerland (CH) |
| **City** | Zurich |
| **ASN** | 402253 |
| **BGP Prefix** | 104.251.180.0/22 |
| **Service Status** | Firewalled / No Services |
| **Open Ports** | None detected |
| **DNS Records** | None |
| **TLS Certificates** | None |
| **Blacklist Count** | 1 of 8 lists |
---
## Network Behavior
- Observation History: 12 signals recorded over recent timeframe
- Threat Persistence: 0 days (no persistent malicious activity)
- Ownership Changes: None detected
- Control Plane: Route stability flagged as unstable; operator score 0.1304 (Minimal)
- ICMP Validation: Blocked (unable to validate via ICMP)
---
## Neighborhood Analysis
Subnet: 104.251.181.106/24
Abuse Density: 0
Total Siblings: 3
| Neighbor IP | Risk Score | Authority Score |
|---|---|---|
| 104.251.181.37 | 50 | 50 |
| 104.251.181.72 | 25 | 50 |
| 104.251.181.78 | 25 | 50 |
*Note: One neighbor (104.251.181.37) exhibits medium risk. Subject IP remains isolated from this neighbor's activity.*
---
## Relationships
- Related Entities: None detected
- Associated Hostnames: None
- Associated Organizations: None
- Associated Certificates: None
---
## Threat Indicators
- Tor Exit Node: No
- Known Attacker: No
- Spam Source: No
- Campaign Matches: 0
- Threat Feeds: None
- WAF Violations: 0
- Honeypot Hits: 0
- Enumeration Strikes: 0
---
## Recommended Actions
Current Risk Level: Monitor Only
- No immediate firewall blocking recommended
- No specific iptables/nftables rules required
- No Cloudflare/AWS WAF rules generated
- Status: Passive infrastructure with no active services
---
## Analyst Notes
The target IP (104.251.181.106) demonstrates characteristics of passive infrastructure—firewalled with no open services. While the subnet shows one medium-risk neighbor, the subject IP maintains isolation and presents no immediate threat indicators. The single DNSBL listing appears to be historical or non-actionable given the absence of active services. SOC teams may consider this address for monitoring if correlated with other threat intelligence, but no blocking action is currently warranted.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | SKN Subnet & Telecom Ltd |
| ASN | AS402253 |
| Network Name | SSTL-49 |
| CIDR Block | 104.251.180.0/22 |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 2 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 25% | 1 | 1 |
| geolocation | 0% | 0 | 0 |
| Overall | 18% | 5 | 5 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-28 22:21:30 UTC |
| Last Seen | 2026-07-30 18:36:07 UTC |
| Profile Built | 2026-07-30 18:45:38 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 17 |
Full dossier details are available via our API.