114.30.104.218📋 Copy

# INTELLIGENCE BRIEFING: 114.30.104.218/32

Classification: High Risk

Date of Analysis: 2026-07-27

Assigned To: SOC Intelligence Unit

## Executive Summary

IP address 114.30.104.218 presents an elevated threat profile with an overall risk score of 80/100. The address is registered to iiNet Limited under ASN 7545 within the 114.30.96.0/19 CIDR block, allocated by APNIC. Despite the high risk classification, the immediate threat indicators show no confirmed malicious activity, with zero blacklist matches and no known attacker attribution.

## Ownership and Infrastructure

Registrant: iiNet Limited

Network Name: IINET-AU

ASN: 7545

CIDR Block: 114.30.96.0/19

Geolocation: Adelaide, South Australia, AU

RIR: APNIC

The IP resolved to hostname 114-30-104-218.tpgi.com.au via DNS. The address is classified as a web server with standard service endpoints.

## Network Services

Open ports identified include:

• Port 80/TCP: HTTP (web server)
• Port 443/TCP: HTTPS (secure web server)
• Port 22/TCP: SSH (dropbear_2018.76)

SSH configuration includes curve25519-sha256 and diffie-hellman key exchange algorithms. No TLS certificates were observed.

## Threat Assessment

Risk Score: 80/100 (High Risk)

Abuse Confidence: Not quantified

Blacklist Status: Listed on 5 of 8 DNS blacklists

Known Campaigns: None

Tor Exit Node: No

Known Attacker: No

Spam Source: No

The elevated risk score correlates with DNS blacklist listings despite absence of direct threat indicators. No specific threat feeds or campaign affiliations were identified.

## Temporal Analysis

Observation Count: 16 historical signals

Threat Persistence: 0 days

Ownership Stability: 0 ownership changes

Route Stability: Unstable (bgpPrefix 114.30.104.0/22)

Recent observations from 2026-07-27 show consistent geolocation and ownership signals with moderate-to-high confidence levels (0.40–0.95).

## Neighborhood Analysis

Subnet: 114.30.104.218/24

Abuse Density: 0

Classification: Clean

Threat Siblings: 0

The /24 subnet shows no adjacent malicious activity, with zero neighboring IPs flagged as threats.

## Relationships

DNS associations link to hostname 114-30-104-218.tpgi.com.au. Network relationships identify affiliation with IINET-AU network block. No certificate or organizational entity relationships were established.

## Recommended Actions

Based on the elevated risk profile, the following defensive measures are recommended:

Immediate Actions:

• Increase logging verbosity for traffic from this source
• Implement firewall rules to block traffic at perimeter and application layers

Firewall Rules (Recommended):

• iptables: `iptables -A INPUT -s 114.30.104.218 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 114.30.104.218 drop`
• nginx: `deny 114.30.104.218;`
• pfsense: Block 114.30.104.218/32
• Cloudflare WAF: Block IP 114.30.104.218
• AWS WAF: Add IP 114.30.104.218/32 to blocked addresses

Note: Recommendations are probabilistic and should be validated against additional contextual signals before implementation.

## Conclusion

IP 114.30.104.218 warrants blocking due to elevated risk score (80/100) and DNS blacklist presence. While no active threat indicators were confirmed, the combination of risk classification and blacklist listings suggests potential abuse. Recommend monitoring for any changes in behavior or emergence of additional threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.