105.235.128.93📋 Copy

# IP Intelligence Briefing: 105.235.128.93/32

## Executive Summary

IP address 105.235.128.93 presents a Moderate Risk profile with a risk score of 40. The IP is assigned to Wataniya Eldjazair (ASN 33779) under the Afrinic RIR. No active threat indicators were detected, but the IP exhibits geographic inconsistencies and limited network activity.

## Ownership and Network Classification

• ASN: 33779 (Wataniya Eldjazair)
• CIDR Block: 105.235.128.0/24
• RIR Registration: Afrinic
• Network Role: Firewalled / No Services
• Infrastructure Type: Not classified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile

## Geolocation Analysis

The IP exhibits conflicting geolocation data:

• Primary Assignment: London, GB (Europe)
• Secondary Signal: Algiers, DZ (Africa)
• GeoConsensus: False (inconsistent sources)
• GeoPlausible: False

This geographic discrepancy warrants attention and may indicate misconfiguration or routing anomalies.

## Threat Intelligence Profile

• Risk Score: 40 (Moderate)
• Abuse Confidence: Not detected
• Blacklist Count: 0
• DNSBL Listings: 2 out of 8 total lists
• Known Campaigns: None detected
• Tor/Proxy/VPN Status: Not active
• Spam Source Status: Not flagged

## Service and Port Analysis

• Open Ports: None detected
• DNS PTR Records: None
• Forward Resolution: Failed
• Hosted Domains: 0
• TLS Certificates: None observed
• HTTP Services: None observed

## Neighborhood Assessment

The /24 subnet (105.235.128.0/24) shows:

• Abuse Density: 0 (minimal)
• High Risk Neighbors: 0
• Total Active Siblings: 0
• Inherited Risk: 0
• Known Threat Siblings: 0

Two sibling IPs identified:

• 105.235.128.25 (no risk score data)
• 105.235.128.147 (no risk score data)

## Historical Signal Analysis

Twelve observations recorded as of 2026-07-21, with signals including:

• Geolocation signals from both UK and Algeria regions
• ASN registration confirming 105.235.128.0/24 assignment to Wataniya Eldjazair
• Operator score of 0.1304 (Minimal)
• No persistent threat indicators
• No ownership changes detected

## Control Plane Assessment

• Route Stability: False
• RPKI State: Not applicable
• IRR Consistency: Not applicable
• Route Changes (30d): 0
• DNSSEC Valid: True
• Operator Score: 0.1304 (Minimal)

## Security Recommendations

Monitoring and Detection

1. Add to monitoring for geographic inconsistency (GB/DZ mismatch)

2. Monitor for service emergence (currently firewalled with no open ports)

3. Track DNSBL listings (2 of 8 lists - monitor for changes)

4. Alert on route stability changes (currently unstable)

Firewall Rules

No immediate blocking recommended based on current risk profile. However, consider:

• Rate limiting if connection attempts increase
• Geographic filtering if DZ/GB inconsistency affects operational requirements
• DNS monitoring for any forward resolution attempts

Further Investigation Triggers

• If DNSBL count increases beyond 2 lists
• If open ports or services appear
• If threat indicators emerge in threat feeds
• If sibling IPs (105.235.128.25, 105.235.128.147) show activity

## Conclusion

IP 105.235.128.93 represents a low-to-moderate risk network resource with no active malicious activity detected. The primary concerns are geographic inconsistency and limited DNSBL presence. No immediate blocking is warranted, but continued monitoring is recommended given the Moderate Risk classification and route stability issues.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.