107.172.195.191📋 Copy

# IP Intelligence Briefing: 107.172.195.191

Target: 107.172.195.191

Risk Classification: Low Risk (Score: 20/100)

ASN: 36352 (HostPapa) | Netname: CC-17 | CIDR Block: 107.172.0.0/14

---

## Executive Summary

The IP 107.172.195.191 presents a low-risk profile with minimal active threat indicators. The address operates as a firewalled endpoint with no open services, though geolocation validation shows implausible coordinate claims. The subnet exhibits moderate abuse density with mixed-classification neighbors.

---

## Ownership and Infrastructure

The IP belongs to HostPapa (ASN 36352) within the CC-17 network block in Elk Grove Village, IL. The address resolves to the PTR hostname 107-172-195-191-host.colocrossing.com under the colocrossing.com domain. DNS configuration includes SPF and DMARC records. The IP maintains a stable control plane with DNSSEC validation but lacks route stability indicators.

---

## Threat Assessment

Threat indicators show no active malicious behavior. Blacklist enumeration returned zero listings across monitored feeds. The IP is not identified as a Tor exit node, known attacker, or spam source. No certificate matches or campaign correlations were detected. The overall control plane operator score was classified as "Minimal" at 0.1304.

---

## Geolocation Anomaly

Geolocation validation flagged implausible coordinate claims. The reported distance of 6713km from the probe location conflicts with the observed RTT of 39ms, which violates the minimum possible RTT of 134.3ms for that distance. This discrepancy indicates unreliable geolocation data or potential spoofing.

---

## Neighborhood Analysis

The /24 subnet 107.172.195.0/24 contains 12 sibling IPs with an abuse density of 0. Risk distribution across the subnet showed 4 medium-risk IPs (score 25-40) and 7 low-risk IPs. Inherited risk for the target IP was assessed at 15. Active sibling count was 1 with 6 threat siblings identified in the broader subnet.

---

## Historical Observations

Signal history recorded 20 observations. Recent activity (as of 2026-07-23) showed one blacklist listing with high severity across 8 total lists. Geolocation probes consistently flagged RTT violations. Control plane signals maintained minimal operator scores throughout the observation window.

---

## Recommended Actions

Immediate: No firewall blocking recommended. The IP presents low-risk characteristics with no active threat indicators.

Monitoring: Monitor for changes in blacklist status and geolocation validation. The subnet's mixed classification warrants periodic review.

Threat Hunting: Investigate the high-severity blacklist listing from 2026-07-23 to determine context and source.

---

Classification: Defensive Security Intelligence

Confidence Level: Medium (based on signal coverage and geolocation validation)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.