170.187.145.111📋 Copy

# IP INTELLIGENCE BRIEFING: 170.187.145.111

Classification: Moderate Risk — Linode Cloud Compute Infrastructure

Date: 2026-07-31

## Executive Summary

IP 170.187.145.111 is a Linode cloud hosting instance located in Atlanta, Georgia with an overall risk score of 65 (Moderate). The IP is associated with DNS hostname "prod-iodine-us-southeast-12.li.binaryedge.ninja" and is listed on 3 of 8 DNS blacklists. No active threat indicators detected; neighborhood abuse density is 0.

## Ownership and Infrastructure

• Provider: Linode (ASN 63949)
• Network Block: 170.187.128.0/17
• Infrastructure Type: CloudCompute / Hosting
• Geolocation: US (Georgia, Atlanta) — geo validation inconclusive (RTT 39ms vs minimum 143.3ms for stated distance)

## Threat Indicators

• Risk Score: 65/100 (Moderate)
• Blacklist Count: 3 DNSBL listings
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Associations: None
• Threat Feeds: No active indicators

## Network Observations

• Open Ports: 22/TCP (SSH - OpenSSH_8.9p1 Ubuntu)
• DNS PTR: prod-iodine-us-southeast-12.li.binaryedge.ninja
• Forward Resolution: Confirmed to binaryedge.ninja domain
• Email Auth: SPF present, DMARC absent

## Neighborhood Analysis (170.187.145.0/24)

• Total Siblings: 10 (8 active)
• Abuse Density: 0
• Subnet Classification: Clean
• Risk Distribution: 0 High, 1 Medium, 8 Low
• Neighboring Risk Scores: Range 25-40 (none exceed 65)

## Historical Trend

Recent signal history (2026-07-31) shows:

• No ownership changes
• No threat persistence observed
• Network classification consistently "clean"
• No campaign correlations detected

## Recommended Actions

SOC Analyst Guidance:

1. Monitor: Track DNSBL removal status for 3 listed blacklists

2. Context: "Binaryedge.ninja" hostname may indicate security/reconnaissance tooling; investigate if legitimate use case exists

3. Mitigation: No immediate blocking required — moderate risk score driven by DNSBL listings, not active malicious activity

4. Neighborhood: No elevated risk from adjacent IPs in /24 subnet; consider subnet-level policy if blocking required

Firewall Rule: Monitor-only recommended unless specific attack correlation occurs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.