105.107.157.233📋 Copy

# IP Intelligence Briefing: 105.107.157.233/32

Classification: Moderate Risk (Score: 50)

Date: Current Analysis

Jurisdiction: Algeria (DZ) — Constantine

---

## Executive Summary

IP address 105.107.157.233 is associated with organization "Security Departement" (ASN 36947) and operates within the 105.107.128.0/18 network block. The IP presents a moderate risk profile (50/100) with no active threat indicators, open services, or known malicious campaign associations. The address is firewalled with no accessible services.

---

## Ownership & Infrastructure

---

## Threat Assessment

Risk Score: 50 (Moderate Risk)

Threat Indicators

• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: Empty

DNSBL Status: Listed on 2 of 8 monitored DNSBLs

---

## Network Analysis

Neighborhood Assessment

• Subnet: 105.107.157.233/24
• Abuse Density: 0 (No abuse activity detected in neighborhood)
• High-Risk Neighbors: 0
• Threat Siblings: 0
• Active Siblings: 0

Control Plane Data

• Route Stability: False (Route changes observed)
• Operator Score: 0.1304 (Minimal)
• DNSSEC Valid: True
• BGP Prefix: 105.107.128.0/18

---

## Technical Profile

Network Role:

• Provider: No
• Infrastructure Type: No
• Cloud/CDN/VPN: No
• Proxy/Tor/Hosting: No
• Mobile/Residential: No
• Bogon/Anycast: No

Services:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Hosted Domains: 0

DNS Analysis:

• PTR Hostnames: None
• Forward Resolution: 0 records
• Forward Hostnames: None
• Email Auth: SPF: No, DMARC: No

---

## Historical Observations

Total Observations: 9 signals

Recent Activity (2026-07-31):

• Geolocation signals confirmed from Constantine, Algeria
• ASN registration validated under "Security Departement"
• ICMP validation blocked (unable to validate)
• No new threat indicators emerged

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False

---

## Relationships

Connected Entities: 1

• Same Network: 105.107.128.0 - 105.107.191.255

No additional relationships detected (hostnames, certificates, organizations beyond network block).

---

## Recommended Security Actions

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 105.107.157.233 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 105.107.157.233 drop

```

nginx:

```nginx

deny 105.107.157.233;

```

pfSense:

```

105.107.157.233/32

```

Cloudflare WAF:

```json

{

"description": "Block 105.107.157.233 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 105.107.157.233"

}

}

```

AWS WAF:

```json

{

"Addresses": ["105.107.157.233/32"],

"Description": "IPDebrief risk 50"

}

```

---

## Analyst Notes

• Risk Context: The moderate risk score (50) is primarily driven by DNSBL listings (2/8 lists) rather than active threat indicators.
• Infrastructure: The IP is firewalled with no accessible services, suggesting it may be an internal or management IP.
• Organizational Indicator: The organization name "Security Departement" (likely Security Department) suggests this may be infrastructure used by a security operations center or similar entity.
• Recommendation: Due to the moderate risk score and DNSBL listings, blocking is recommended, but the lack of active threat indicators

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.