105.235.132.175📋 Copy

# IP Intelligence Briefing: 105.235.132.175/32

## Executive Summary

IP address 105.235.132.175 presents a moderate risk profile (score: 40) with limited active threat indicators. The address belongs to ASN 33779 (Wataniya Eldjazair) and is classified as a firewalled host with no open services. While not actively malicious, the IP warrants monitoring and consideration for blocking in controlled environments.

## Network Attribution & Infrastructure

• Organization: Wataniya Eldjazair (Algerian ISP)
• ASN: 33779
• CIDR Block: 105.235.132.0/24
• Geolocation: London, GB (Note: Geolocation discrepancy exists; ASN indicates Algerian origin)
• Network Classification: Firewalled / No Services detected
• DNS: No PTR records, no forward resolution, no hosted domains

## Threat Assessment

• Risk Score: 40 (Moderate Risk)
• Known Threats: None detected
• Blacklist Status: 0 blacklist hits
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Indicators:

• Route stability: Not stable
• DNSBL listings: 2 of 8 total lists
• RPKI state: Unverified
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis (105.235.132.0/24)

• Abuse Density: 0.0 (Clean)
• Subnet Classification: Clean
• Active Siblings: 2
• Threat Siblings: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 2

Notable Neighbors:

• 105.235.132.1 (Risk Score: 40, Authority Score: 50)
• 105.235.132.170 (Risk Score: 40, Authority Score: 50)

## Historical Observations

• Total Observations: 14
• Threat Persistence: None detected
• Ownership Changes: 0
• Recent Activity: Scans detected on multiple ports (no services confirmed)
• Campaign Correlation: None

## Recommended Actions

Based on the risk profile, the following security controls are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 105.235.132.175 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 105.235.132.175 drop`
• nginx: `deny 105.235.132.175;`

WAF/Cloud Services

• Cloudflare WAF: Block with expression `ip.src eq 105.235.132.175`
• AWS WAF: Add 105.235.132.175/32 to IP set for blocking

## Analyst Notes

The IP exhibits moderate risk characteristics primarily due to DNSBL listings and unstable routing. However, the subnet demonstrates clean abuse density with no active malicious siblings. The firewalled status suggests the IP is not currently serving open services, reducing immediate exploitation risk. SOC teams should monitor for any changes in network behavior or emergence of threat indicators in the associated neighborhood.

*Report generated: 2026-07-29*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.