111.90.145.42
## IP Intelligence Briefing: 111.90.145.42/32
Classification: Moderate Risk (Risk Score: 40)
Analysis Date: July 2026
Data Source: IPDebrief Threat Intelligence Platform
---
**1. Ownership and Network Classification**
IP 111.90.145.42 is assigned to ASN 45839, Shinjiru Technology Sdn Bhd (SHINJIRU-MY), registered with APNIC in Malaysia. The IP resides within CIDR block 111.90.128.0/19 and geolocates to coordinates 4.21°N, 101.98°E (Kuala Lumpur timezone). The operator score is minimal (0.1304), indicating limited operator-level threat activity.
**2. Threat Indicators**
- Primary Classification: Tor Exit Node (historically classified with 85% confidence)
- DNSBL Status: Listed on 2 of 8 DNS blacklists
- Abuse Confidence: Not explicitly scored; no known attacker or spam source flags in current profile
- Campaign Correlation: No associated campaigns or certificate matches detected
- Persistence: No evidence of persistent malicious behavior (threat observation count: 0)
**3. Network Behavior and Services**
- Service Status: No open ports or active services detected; connection classified as "Firewalled / No Services"
- DNS Resolution: PTR hostname resolves to server1.kamon.la; forward resolution not confirmed
- Network Traceroute: 20 hops via Comcast and HE transit networks; final hop latency 266.2ms
**4. Subnet and Neighborhood Analysis**
The /24 subnet (111.90.145.0/24) shows clean classification with:
- Abuse Density: 0
- High-risk neighbors: 0
- Medium-risk neighbors: 0
- Active sibling IPs: 0
No correlated threat activity detected in adjacent IP space.
**5. Temporal Observations**
19 historical observations recorded through July 24, 2026. Most recent signals indicate:
- Tor Exit Node classification persisted with 85% confidence
- Minimal operator score (0.15)
- No ownership changes or threat persistence indicators
**6. Recommended Defensive Actions**
Based on risk profile, the following firewall rules are recommended:
| Platform | Recommended Rule |
|---|---|
| iptables | `iptables -A INPUT -s 111.90.145.42 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 111.90.145.42 drop` |
| nginx | `deny 111.90.145.42;` |
| pfSense | Block 111.90.145.42/32 |
| Cloudflare WAF | Block rule: `ip.src eq 111.90.145.42` |
| AWS WAF | Add IP 111.90.145.42/32 to block list |
**7. Intelligence Assessment**
IP 111.90.145.42 exhibits characteristics consistent with Tor exit node infrastructure. While currently showing no active service exposure, historical classification and DNSBL listings warrant blocking. The clean neighborhood and minimal operator score suggest this may be an isolated Tor relay rather than part of a coordinated attack infrastructure. SOC teams should monitor for service activation or DNS changes while maintaining the recommended blocking posture.
Priority Level: Moderate
Action Required: Implement blocking rules per platform recommendations
Monitoring: Track for service activation, DNS changes, or increased risk scores
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Shinjiru Technology Sdn Bhd administrator |
| ASN | AS45839 |
| Network Name | SHINJIRU-MY |
| CIDR Block | 111.90.128.0/19 |
| RIR | APNIC |
| Country | MY |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server1.kamon.la |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | server1.kamon.la |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
CN=www.lrarcf5l3kqvaiy.net was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | None |
| Valid From | 2026-07-26T00:00:00+00:00 |
| Valid Until | 2026-09-20T00:00:00+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 56 days |
🛡️ Public Network Snapshot
| Origin ASN | AS45839 |
| Network Prefix | 111.90.144.0/21 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 28% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 24% | 2 | 3 |
| ownership | 17% | 2 | 3 |
| reputation | 16% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 20% | 10 | 17 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-07 04:09:36 UTC |
| Last Seen | 2026-08-30 06:02:15 UTC |
| Profile Built | 2026-09-02 19:34:07 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 27 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 111.90.145.42
Who owns the IP address 111.90.145.42?
111.90.145.42 is registered to Shinjiru Technology Sdn Bhd administrator. The address falls within the 111.90.128.0/19 network block. Registration is held at APNIC.
Where is 111.90.145.42 located?
Geolocation data places 111.90.145.42 in Boston. The local time zone is Asia/Kuala_Lumpur. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 111.90.145.42 malicious or safe?
111.90.145.42 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 111.90.145.42?
The reverse DNS (PTR) record for 111.90.145.42 is server1.kamon.la. This hostname is not forward-confirmed, so it should be treated as a weak signal.
What ports are open on 111.90.145.42?
Responsive ports observed on 111.90.145.42 include 80, 443. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.