105.76.170.212📋 Copy

# IP Intelligence Briefing: 105.76.170.212/32

## Executive Summary

IP address 105.76.170.212 is classified as LOW RISK with a risk score of 0. The address belongs to network ORG-MC5-AFRINIC (ASN 36884) operated by Hassan Elmansouri, geolocated to Oujda, Oriental region, Morocco (MA). No threat indicators, blacklist entries, or active abuse signals were detected. No recommended security actions are currently required.

## Infrastructure Profile

## Threat Assessment

Risk Score: 0/100

Abuse Confidence: None

Threat Indicators: None detected

Blacklist Count: 0

Known Campaigns: None

Tor Exit Node: No

Proxy/VPN: No

Known Attacker: No

Spam Source: No

The IP shows no evidence of malicious activity. Threat feeds, blacklist sources, and known campaign correlations are empty. The network role is classified as "Firewalled / No Services" with no open ports detected on services scanning.

## Network Behavior & Control Plane

The control plane indicates route instability with 0 route changes in the last 30 days. DNSSEC validation is enabled.

## Neighborhood Analysis

Subnet: 105.76.170.0/24

Neighbor Count: 0

Abuse Density: 0 (no abusive siblings detected)

Risk Distribution: 0 high, 0 medium, 0 low

Classification: None

No neighboring IPs in the /24 subnet show elevated risk indicators. The subnet exhibits zero abuse density.

## Historical Observations

Total Observations: 11 signals recorded

Observation Period: Recent activity on 2026-07-27

Key historical signals include:

• ASN/geolocation data from Afrinic registry (confidence 0.95)
• Network classification signals (confidence 0.30)
• Control plane operator scoring (confidence 0.30)
• Multi-dimensional profile assessment (confidence 0.18)

Temporal analysis shows:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently malicious: No

## Relationships

The IP exhibits 2 relationships, both classified as "Same Network" pointing to ORG-MC5-AFRINIC. No hostname, certificate, or organizational relationships were identified.

## Recommended Actions

Current Status: No actions required

Risk-Based Recommendations: None

The IP address presents no immediate threat to defensive operations. Standard baseline monitoring is sufficient.

---

Analyst Notes: While the IP shows no active threats, the combination of route instability (routeStable: false), geoPlausible: false, and zero sibling activity in the /24 subnet warrants continued observation. The Afrinic registration and Oujda geolocation are consistent with the ASN record. No blocking or filtering is recommended at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.