109.72.12.37📋 Copy

# INTELLIGENCE BRIEFING: 109.72.12.37/32

## Executive Summary

IP 109.72.12.37 presents a MODERATE RISK profile (score: 55/100) with mixed threat indicators. The IP operates as a web server in Příbram, Czech Republic (ASN 49767, Lukas Holzel) and exhibits dynamic network characteristics with elevated DNSBL presence. Neighborhood analysis shows clustered medium-risk activity within the /24 subnet.

## Technical Profile

## Threat Indicators

• DNSBL Listings: 3 of 8 total lists (high-severity listings present)
• Control Plane: Route stability compromised, DNSSEC valid
• Operator Score: 0.1304 (Minimal)
• Known Campaigns: None identified
• Tor/Proxy/CDN: Not classified
• Threat Feeds: No direct threat indicators

## Network Neighborhood Analysis

Subnet 109.72.12.37/24 shows clean classification with 0% abuse density, though clustered activity detected:

• Active Siblings: 2 IPs (109.72.12.68, 109.72.12.204)
• Neighbor Risk Scores: 55/100 (both medium-risk)
• Total Siblings: 3 (2 active, 1 inactive)
• Abuse Density: 0%

## Observation History (21 signals tracked)

Temporal analysis reveals intermittent activity patterns:

• June 17, 2026: Connection failures recorded (HTTPS)
• June 17, 2026: DNSBL listings detected (3 high-severity)
• June 22, 2026: Recent operator score assessment (Minimal risk)
• Threat Persistence: 0 days observed
• Ownership Changes: 0 events

## Relationship Graph

43 relationships identified, predominantly same-network associations (IPB_DYNAMIC_NAT). No direct organizational or certificate-based links to known malicious entities.

## Recommended Actions

Risk Level: High (score 55/100)

Primary Recommendation: Increase logging verbosity and review recent activity

Firewall Rules

• iptables: `iptables -A INPUT -s 109.72.12.37 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 109.72.12.37 drop`
• nginx: `deny 109.72.12.37;`
• pfSense: `109.72.12.37/32`
• Cloudflare WAF: Block (expression: `ip.src eq 109.72.12.37`)
• AWS WAF: Block (Addresses: `109.72.12.37/32`)

## Intelligence Assessment

The IP exhibits characteristics of a legitimate but potentially compromised or misconfigured web hosting resource. The presence of SSH access (port 22), multiple DNSBL listings, and route instability suggest either security hardening issues or prior abuse. The neighborhood clustering with identical risk scores indicates a pattern of behavior within the subnet. While not classified as persistently malicious, the moderate-to-elevated risk profile warrants monitoring and consideration of blocking if the IP appears in threat traffic logs.

Classification: Moderate Risk – Monitor/Block Based on Context

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.