105.246.35.25📋 Copy

## IP INTELLIGENCE BRIEFING: 105.246.35.25/32

Classification: Moderate Risk (Score: 50)

Date: 2026-07-27

Analyst: IPDebrief Intelligence Team

---

EXECUTIVE SUMMARY

IP 105.246.35.25 presents moderate-risk indicators with conflicting geolocation data and confirmed DNSBL listings. The address is associated with Vodacom South Africa (ASN 36994) but shows routing instability. Currently firewalled with no active services detected.

---

OWNERSHIP & INFRASTRUCTURE

• ASN: 36994 (Vodacom - Vodacom, ZA)
• RIR: AFRINIC
• CIDR Block: 105.246.32.0/20
• Route Stability: UNSTABLE (route changes detected within 30 days)
• Geolocation Discrepancy: Current profile indicates GB/London; historical data confirms ZA (South Africa) coordinates (−30.56°S, 22.94°E). This conflict requires validation.
• Hostname: vc-vb-105-246-35-25.ens.vodacom.co.za
• Network Role: Firewalled/No Services (no open ports detected)

---

THREAT INDICATORS

• DNSBL Status: Listed on 2 of 8 threat feeds
• Maximum Severity: HIGH
• Blacklist Count: 2
• Known Campaigns: None identified
• Tor Exit Node: No
• Residential/Hosting: Not classified

---

OBSERVATION HISTORY (14 observations)

Recent activity shows:

• Geolocation: Historical signals confirm South Africa (ZA) with 800km accuracy
• DNSSEC: Valid (RRSIG present)
• BGP Prefix: 105.246.32.0/20 (Vodacom)
• Threat Persistence: 0 days (no persistent malicious activity detected)
• Ownership Changes: 0 changes recorded

---

NEIGHBORHOOD ANALYSIS

• Subnet: 105.246.35.0/24
• Abuse Density: 0%
• Threat Siblings: 0 detected
• Classification: No inherited risk from subnet neighbors

---

RECOMMENDED ACTIONS

Immediate: Block inbound traffic from this IP address using the following rules:

```bash

# iptables

iptables -A INPUT -s 105.246.35.25 -j DROP

# nftables

nft add rule inet filter input ip saddr 105.246.35.25 drop

# pfSense

105.246.35.25/32

```

WAF Configuration:

• Cloudflare: Block with filter expression `ip.src eq 105.246.35.25`
• AWS WAF: Add to blacklist with description "IPDebrief risk 50"

---

ANALYSIS NOTES

1. Geolocation Conflict: The discrepancy between GB and ZA locations warrants investigation. Potential causes include Anycast deployment, routing manipulation, or database inconsistency.

2. Vodacom Association: The hostname and ASN confirm South African telecommunications infrastructure. However, the UK geolocation tag may indicate the IP is being routed through international transit.

3. DNSBL Listings: Two blacklist entries with high severity suggest prior abuse or suspicious activity. The current firewalled status may indicate decommissioning or mitigation.

4. Route Instability: The unstable BGP routing flag suggests active manipulation or changes in network topology.

---

RISK RATING: MODERATE

Justification: Risk score of 50 reflects moderate concern due to DNSBL listings and geolocation inconsistencies. No active malicious campaigns detected. Monitor for changes in threat indicators or geolocation patterns.

---

*Report generated by IPDebrief Intelligence Platform. All data sourced from network observations and threat intelligence feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.