104.64.221.171📋 Copy

# IP Intelligence Briefing: 104.64.221.171

## Executive Summary

IP address 104.64.221.171 is a Linode cloud compute infrastructure endpoint with a moderate risk score of 50. The IP is located in Singapore and is associated with the 104.64.192.0/19 BGP prefix (ASN 63949). No active threat indicators, campaigns, or malicious behavior were detected. The IP appears to be a legitimate cloud-hosted service endpoint.

## Technical Profile

Classification: Cloud compute infrastructure (Linode)

Country: Singapore (SG)

ASN: 63949

BGP Prefix: 104.64.192.0/19

DNS Hostname: 104-64-221-171.ip.linodeusercontent.com

PTR Resolution: Forward confirmed

Services: No open ports detected (firewalled/no services)

DNSBL Status: Listed on 2 of 8 threat lists

## Risk Assessment

• Overall Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not scored
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Persistently Malicious: No

## Neighborhood Analysis

The /24 subnet (104.64.221.0/24) shows low abuse density with only 1 active sibling IP identified:

• 104.64.221.249 (Risk Score: 25, Authority Score: 60)
• No high or medium-risk neighbors detected in the immediate vicinity

## Relationship Graph

• DNS Associations: 104-64-221-171.ip.linodeusercontent.com
• No additional organizational, certificate, or hostname relationships identified beyond DNS PTR records

## Historical Observations

14 signal observations recorded over the monitoring period. Recent signals include:

• Ownership and RIR registration data (ARIN)
• Operator scoring with basic classification
• No persistent malicious activity patterns detected
• Geographic consensus confirmed

## Security Recommendations

Based on the risk profile, the following firewall rules are available for deployment:

iptables:

```bash

iptables -A INPUT -s 104.64.221.171 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 104.64.221.171 drop

```

Cloudflare WAF:

```json

{

"description": "Block 104.64.221.171 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 104.64.221.171"

}

}

```

AWS WAF:

```json

{

"Addresses": ["104.64.221.171/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Notes

The moderate risk score (50) correlates with DNSBL listings on 2 of 8 threat feeds, suggesting prior abuse reporting but no current malicious activity. The IP is hosted on Linode cloud infrastructure in Singapore with no open services detected, indicating it may be a backend service or firewalled endpoint. The low neighborhood abuse density and absence of threat indicators support a cautious monitoring approach rather than immediate blocking.

Recommendation: Monitor for behavioral changes or additional threat indicators. Current profile does not warrant immediate blocking, but consider geo-blocking or rate-limiting based on organizational policy for Singapore-origin traffic.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.