109.207.35.178📋 Copy

# IP Intelligence Briefing: 109.207.35.178/32

## Executive Summary

IP address 109.207.35.178 is classified as High Risk (Risk Score: 70). The address is associated with TRUF network infrastructure in Serbia and shows no active open services. While the IP itself shows no direct threat indicators, it resides within a subnet containing 20 medium-risk neighbors, suggesting potential lateral threat activity.

## Network Profile

• IP Address: 109.207.35.178
• Risk Score: 70 (High Risk)
• Organization: AS6700-MNT / TRUF
• ASN: 52026
• Country: Serbia (RS)
• CIDR Block: 109.207.32.0/20
• Geolocation: Datacenter/ISP facility (www.kbcnet.rs)
• Network Role: Firewalled / No Services
• RIR: ARIN

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 4 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Open Ports: None detected
• Active Services: None detected

## Control Plane Analysis

• Origin ASN: 52026
• BGP Prefix: 109.207.35.0/24
• Route Stability: False (route changes detected)
• RPKI State: Not validated
• Delegation Age: Data unavailable

## Neighborhood Assessment (109.207.35.0/24)

• Total Siblings: 35
• Abuse Density: 0.0278 (Low)
• Risk Distribution:

- High Risk: 0

- Medium Risk: 20

- Low Risk: 11

• Notable High-Risk Neighbors:

- 109.207.35.177 (Risk: 70)

- 109.207.35.205 (Risk: 70)

- 109.207.35.206 (Risk: 70)

- 109.207.35.149 (Risk: 45)

## Observation History

12 signal observations recorded. Most recent activity (2026-07-22) indicates:

• Classification: Clean with inherited risk
• Threat observation count: 0
• Ownership changes: 0
• Not persistently malicious
• Subnet abuse density: 0.0278

## Relationships

Two "Same Network" relationships identified, both linking to TRUF network infrastructure.

## Recommended Actions

1. Monitor the subnet 109.207.35.0/24 for elevated activity, particularly from neighbors 109.207.35.177, 109.207.35.205, and 109.207.35.206

2. Block 109.207.35.178 at perimeter firewalls if traffic is not expected from this location

3. Monitor for connection attempts from the subnet during off-hours

4. Verify business legitimacy if traffic from this IP is observed

## SOC Analyst Notes

This IP represents a high-risk classification primarily due to its risk score of 70. However, no direct threat indicators (blacks, known campaigns, active attacks) are present. The primary concern is the subnet-level risk distribution, with 20 medium-risk neighbors in the same /24 block. The route instability flag suggests potential infrastructure changes that may warrant monitoring.

Priority: Medium - Monitor rather than immediate block unless malicious activity is observed.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.