118.145.104.105📋 Copy

# IP INTELLIGENCE BRIEFING: 118.145.104.105

## Executive Summary

IP address 118.145.104.105 is classified as MODERATE RISK (score: 50). The address belongs to Chinese infrastructure provider IRT-VOLCANO-ENGINE-CN (ASN 137718) and shows limited threat indicators with 2 DNSBL listings out of 8 checked sources. No active malicious behavior observed; classified as "Firewalled / No Services" with no open ports.

## Ownership & Registration

## Risk Assessment

• Overall Risk Score: 50/100 (Moderate)
• Threat Indicators: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (current state), 2 historical listings
• Abuse Confidence Score: Not applicable (insufficient data)
• Control Plane Risk: Operator score 0.1304 (Minimal)

## Network Characteristics

• Service Classification: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: Forward resolution fails; no PTR hostnames
• Hosted Domains: 0
• Email Auth: SPF/DMARC not configured
• HTTP/HTTPS: No web services detected (no TLS cert, no HTTP title)
• Mobile Carrier: None

## Neighborhood Analysis (/24 Subnet)

• Subnet: 118.145.104.0/24
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0 (clean)
• Risk Distribution: High: 0, Medium: 1, Low: 1
• Neighbor IPs: 118.145.104.37 (risk: 50), 118.145.104.154 (risk: 25)

## Historical Signals (14 Observations)

• Most Recent: 2026-06-22T10:46:08Z
• DNSBL Activity: Listed on 8 sources, 2 active listings with "high" severity
• Geolocation Signals: Consistently resolved to China (CN) with 0.52 confidence
• Operator Score: 0.1304 (Minimal)
• Ownership Stability: 0 ownership changes recorded
• Threat Persistence: 0 days (not persistently malicious)

## Control Plane & Routing

• Origin ASN: 137718
• BGP Prefix: 118.145.104.0/21
• Route Stability: False (0 route changes in 30 days)
• RPKI State: Not validated
• DNSSEC: Valid
• IRR Consistency: Not evaluated

## Threat Campaign Correlation

• Campaign Likelihood: Not applicable
• Certificate Matches: 0
• Banner Matches: 0
• Correlated IPs: 0

## Recommended Security Actions

Based on risk profile, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 118.145.104.105 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 118.145.104.105 drop

```

nginx:

```nginx

deny 118.145.104.105;

```

Cloudflare WAF:

```json

{

"description": "Block 118.145.104.105 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 118.145.104.105"

}

}

```

AWS WAF:

```json

{

"Addresses": ["118.145.104.105/32"],

"Description": "IPDebrief risk 50"

}

```

## Analyst Notes

This IP represents a moderately risky address with limited observable threat activity. The moderate risk score (50) correlates with historical DNSBL listings but no current malicious indicators. The neighborhood analysis shows low abuse density (0), and only one sibling IP in the /24 carries medium risk. Given the lack of open services and the "firewalled" classification, this IP may represent infrastructure that is intentionally restricted or in decommissioning. SOC teams should evaluate contextual threat intelligence before implementing blocking rules, as the risk profile suggests opportunistic rather than active malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.