110.173.134.43📋 Copy

## IP Intelligence Briefing: 110.173.134.43/32

Executive Summary

IP address 110.173.134.43 is assigned to Digital Pacific (IRT-HOSTOPIA-AU) and carries a Moderate Risk score of 50. The IP is currently firewalled with no active services and exhibits no known threat indicators. However, the asset is listed on 2 out of 8 DNS blacklist checks and shows geolocation inconsistencies requiring further investigation.

Ownership and Network Infrastructure

• ASN: 55803
• Organization: IRT-HOSTOPIA-AU
• Network: DIGITALPACIFIC (110.173.132.0/22)
• RIR: APNIC
• Registration Date: Not available
• Abuse Contact: abuse@hostopia.com.au

The IP is registered within the Digital Pacific infrastructure, a known Australian hosting provider. No evidence of cloud, CDN, VPN, or proxy services detected.

Geolocation Analysis

• Reported Location: United States, Illinois, Chicago
• Network Registration: Australia (Strawberry Hills, NSW)
• Status: ⚠️ Geolocation Discrepancy Detected

The IP shows conflicting geolocation data between the network registration (Australia) and current geolocation reports (United States). This inconsistency may indicate hosting infrastructure misconfiguration or potential spoofing.

Threat Intelligence Assessment

• Risk Score: 50 (Moderate)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 2 (of 8 DNSBL checks)
• Known Campaigns: None detected
• Threat Persistence: Not persistently malicious

The IP exhibits no active threat indicators. However, listing on 2 DNS blacklists suggests prior reputation issues or false positives requiring verification.

Technical Profile

• Service Status: Firewalled / No Services
• Open Ports: None detected
• DNS PTR: 110.173.134.43-static.digitalpacific.com.au
• HTTP Services: None detected
• Certificate Authority: Not applicable
• Route Stability: Unstable (isRouteStable: false)

Observation History

15 observations recorded over the monitoring period. Recent signals indicate:

• Ownership stability maintained (no ownership changes)
• Geolocation signals showing conflicting data between US and AU
• DNSBL listings present with mixed severity ratings
• No escalation in threat persistence metrics

Neighborhood Analysis

The /24 subnet (110.173.134.0/24) shows:

• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Risk Distribution: None

No neighboring IP addresses present additional threat context.

Recommended Actions

Based on the moderate risk profile and DNSBL listings, consider the following defensive measures:

Immediate Mitigation:

• Block at perimeter firewall using provided iptables/nftables rules
• Implement Cloudflare WAF rule: `ip.src eq 110.173.134.43` → Block
• Configure AWS WAF: Add 110.173.134.43/32 to block list

Investigation Priority:

1. Verify geolocation discrepancy through reverse DNS and traceroute analysis

2. Review DNSBL listing sources to determine if listings are justified

3. Monitor for any changes in service patterns or reputation metrics

Intelligence Narrative

IP 110.173.134.43 presents moderate risk primarily due to DNS blacklist listings and geolocation inconsistencies. The Digital Pacific hosting infrastructure shows no evidence of active malicious use, but the geolocation mismatch between network registration and reported location warrants investigation. The IP should be blocked at network perimeters while maintaining monitoring for any reputation changes. No correlation with known threat campaigns or malicious infrastructure clusters detected.

---

*Briefing generated from IPDebrief intelligence platform data. SOC teams should combine these findings with local threat intelligence before implementing blocking actions.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.