135.13.28.35📋 Copy

# IP INTELLIGENCE BRIEFING: 135.13.28.35/32

Classification: Moderate Risk (Score: 50/100)

Date: Current Assessment

Analyst: IPDebrief Intelligence Team

## Executive Summary

IP address 135.13.28.35 is registered to Microsoft Azure (ASN 8075) and is hosted in Chennai, Tamil Nadu, India. The IP operates within a cloud compute environment with minimal active services. Historical observations indicate persistent cloud infrastructure with sporadic DNSBL listings. The IP presents moderate risk due to cloud hosting classification and historical blacklist associations.

## Technical Profile

## Threat Intelligence Assessment

Indicators of Compromise

• Blacklist Status: Listed on 2 DNSBL entries (out of 8 total threat feeds)
• Campaign Association: No known attack campaigns correlated
• Tor Exit Node: Not detected
• Known Attacker: No indicators in threat databases
• Spam Source: Not classified as spam source

Network Behavior

• Service Exposure: Firewalled / No services detected
• Open Ports: None identified
• TLS/Certificate: No certificate data available
• PTR Records: None resolved

Control Plane Analysis

• BGP Prefix: 135.13.0.0/16
• Route Stability: Unstable (route changes detected in last 30 days)
• RPKI State: Not verified
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis

Subnet: 135.13.28.0/24

Abuse Density: 1 (Low)

Classification: Mostly Clean

Total Siblings: 1

Active Siblings: 0

Threat Siblings: 1

The /24 subnet exhibits low abuse density, consistent with Microsoft Azure cloud infrastructure patterns. The single threat sibling may represent related infrastructure activity within the same cloud provider network.

## Historical Observations

The IP has generated 16 signal observations since initial discovery, with the most recent recorded on 2026-06-29. Historical data shows:

• Consistent cloud infrastructure classification
• Sporadic DNSBL listing activity (2 lists)
• Minimal service exposure changes
• No persistent malicious behavior indicators
• Ownership and registration stable

## Recommended Actions

Based on the risk profile, the following defensive measures are recommended:

Immediate Blocking:

```bash

# iptables

iptables -A INPUT -s 135.13.28.35 -j DROP

# nftables

nft add rule inet filter input ip saddr 135.13.28.35 drop

# nginx

deny 135.13.28.35;

```

WAF/Cloud Security:

• Cloudflare WAF: Block via IP expression filter
• AWS WAF: Add to IP set for blocking
• pfSense: Apply rule for 135.13.28.35/32

Monitoring Priorities:

• Monitor for service exposure changes on this IP
• Track DNSBL listing updates
• Watch for correlated activity in 135.13.28.0/24 subnet

## Intelligence Narrative

135.13.28.35 represents a Microsoft Azure cloud compute endpoint in India. The moderate risk classification stems from historical DNSBL associations and route instability, rather than active malicious behavior. The IP currently presents a low service attack surface with no open ports or exposed services. Cloud hosting environments in this subnet show low abuse density, suggesting legitimate infrastructure usage. However, the persistent presence on DNSBL lists warrants continued monitoring and defensive blocking until threat indicators diminish.

---

Status: Monitor | Confidence: Medium | Next Review: 7 days

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.