110.25.109.70📋 Copy

# IP INTELLIGENCE BRIEFING: 110.25.109.70/32

## Executive Summary

IP 110.25.109.70 presents a moderate risk profile (Risk Score: 40) originating from Taiwan. The IP is associated with FEG-MPLS-NETWORK-NET under ASN 9674. While the address itself shows no active open services, the /24 subnet exhibits high abuse density with 12 active neighbors, 9 of which are threat siblings.

## Ownership and Infrastructure

• Organization: Jeff Ho / FEG-MPLS-NETWORK-NET
• ASN: 9674 (APNIC RIR)
• CIDR Block: 110.25.0.0/16
• Geolocation: Panchiao, Taipei, Taiwan (23.7°N, 120.96°E)
• Reverse DNS: 110-25-109-70.adsl.fetnet.net
• Classification: Firewalled / No Services (no open ports or TLS certificates detected)

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• DNSBL Listings: 2 of 8 total lists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Activity: None detected
• Threat Persistence: 0 days observed

## Neighborhood Analysis

The /24 subnet (110.25.109.70/24) demonstrates elevated abuse characteristics:

• Abuse Density: 0.6923 (High Abuse)
• Active Neighbors: 12
• Threat Siblings: 9
• Risk Distribution: 2 high-risk (70-80), 10 medium-risk (40-55), 0 low-risk

Notable high-risk neighbors:

• 110.25.109.52 (Risk: 80)
• 110.25.109.54 (Risk: 80)
• 110.25.109.53 (Risk: 70)
• 110.25.109.58 (Risk: 70)

## Temporal Analysis

Observation history indicates 24 recorded signals with consistent geographic attribution to Taiwan. The IP maintains moderate risk stability with no evidence of escalating malicious activity. Recent observations (June 2026 timeframe) show continued presence in blacklist databases.

## Recommended Actions

Based on the risk profile, the following blocking rules are recommended across security infrastructure:

Firewall Rules:

• `iptables -A INPUT -s 110.25.109.70 -j DROP`
• `nft add rule inet filter input ip saddr 110.25.109.70 drop`
• `nginx: deny 110.25.109.70;`
• `pfSense: 110.25.109.70/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 110.25.109.70`
• AWS WAF: Include address `110.25.109.70/32`

## Intelligence Notes

1. Subnet Context: The parent /24 subnet shows high abuse density (0.6923), suggesting coordinated or shared infrastructure usage. Blocking the individual IP may not mitigate broader subnet-level risks.

2. No Active Services: The IP appears firewalled with no detectable open ports or web services, limiting direct exploitation vectors.

3. Geographic Consistency: Multiple observation signals confirm Taiwan origin with consistent reverse DNS resolution.

4. Blacklist Presence: Presence on 2 DNSBLs warrants continued monitoring but indicates limited spam distribution activity.

## Conclusion

IP 110.25.109.70 represents a moderate-risk infrastructure address from Taiwan with no active service exposure. The high-abuse density of the /24 subnet suggests potential for related malicious activity from neighboring addresses. Recommended action is blocking at perimeter defense layers with continued monitoring of subnet-level activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.