109.172.55.64📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 109.172.55.64/32

Classification: Moderate Risk / Known Attacker

Date: 2026-06-17

## Executive Summary

IP address 109.172.55.64 is classified as a moderate-risk address (risk score: 49) with confirmed malicious indicators. The IP is registered to Global Connectivity Solutions (ASN 215540) in Lille, France. While the /24 subnet shows clean abuse density, this specific endpoint has been flagged as a known attacker with blacklist listings. SSH service is active, and control plane data indicates route instability.

## Risk Assessment

• Overall Risk Score: 49/100 (Moderate Risk)
• Reputation Status: Known Attacker (isKnownAttacker: true)
• Blacklist Exposure: 1 of 8 DNSBL lists
• Operator Score: 0.1304 (Minimal)
• Threat Indicators: Emerging Threats classification present

## Technical Profile

Network & Ownership

Services & Ports

DNS Analysis

Control Plane Data

• BGP Prefix: 109.172.55.0/24
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC: Valid
• DNSBL Listings: 1 active listing
• MOAS Status: Not observed
• Origin ASN: 215540

## Neighborhood Analysis

Subnet: 109.172.55.0/24

• Abuse Density: 0 (Clean)
• Subnet Classification: Clean
• Sibling IPs: 1 total

- 109.172.55.136: Risk score 0, Authority score 50 (clean)

• Threat Siblings: 0

## Observation History

Total observations: 24

• Recent Activity: Blacklist listings detected (confidence: 0.60)
• Geolocation Inference: France (confidence: 0.28)
• Operator Score Trend: 0.15 → 0.1304 (stable minimal operator risk)
• Threat Persistence: 0 days (not persistently malicious)

## Relationship Graph

66 relationships identified, predominantly "Same Network" connections to GCS_SER-NET network identifiers. No certificate or organization-level relationships detected.

## Recommended Actions

Immediate Mitigation

Severity: HIGH

Intelligence Notes

1. Despite clean neighborhood metrics, this specific endpoint shows malicious behavior patterns

2. SSH service availability indicates potential for lateral movement or unauthorized access

3. Route instability suggests possible infrastructure changes or misconfiguration

4. Single DNSBL listing provides confirmation of prior malicious activity

## Conclusion

This IP warrants defensive blocking at network boundaries. The combination of known attacker classification, blacklist presence, and active SSH service presents a credible threat vector. Recommend monitoring for any related IPs within the 109.172.55.0/24 subnet, though current sibling analysis indicates no additional threats.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.