172.104.241.98📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 172.104.241.98/32

Classification: Linode Cloud Compute Instance

Date: 2026-06-18

Risk Score: 40/100 (Moderate Risk)

---

## EXECUTIVE SUMMARY

IP 172.104.241.98 is a Linode cloud compute instance exhibiting moderate risk characteristics with limited service exposure. The IP resolved to a research domain (academyforinternetresearch.org) and shows evidence of DNSBL listing (2/8 lists). Neighborhood analysis indicates a 50% abuse density within the /24 subnet with one additional threat sibling detected.

---

## OWNERSHIP & GEOLOCATION

The IP operates within Linode's cloud infrastructure. Control plane data indicates origin ASN 63949 with stable routing but route stability flagged as false.

---

## DNS & HOSTING ANALYSIS

The IP maintains a reverse DNS entry pointing to a research organization domain. Forward confirmation is established with no additional hosted domains.

---

## NETWORK SERVICES

No active services or open ports were detected during network probing. The instance appears to be actively firewalled.

---

## THREAT INDICATORS

DNSBL Evidence: Signal history reveals listing on 2 threat feeds with "high" severity rating observed on 2026-06-17.

---

## TEMPORAL ANALYSIS

Observation history indicates stable characteristics with no significant risk escalation. The IP shows minimal signal variation over the monitoring period.

---

## NEIGHBORHOOD ANALYSIS (172.104.241.0/24)

Neighbor Alert: 172.104.241.92 detected with risk score 50 and authority score 60. Both IPs share the same subnet but the neighbor exhibits higher risk characteristics.

---

## RELATIONSHIP GRAPH

---

## SECURITY RECOMMENDATIONS

Based on risk score 40 and DNSBL listing evidence, the following actions are recommended:

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 172.104.241.98 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 172.104.241.98 drop

```

nginx:

```nginx

deny 172.104.241.98;

```

Cloudflare WAF:

```json

{

"description": "Block 172.104.241.98 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 172.104.241.98"

}

}

```

AWS WAF:

```json

{

"Addresses": ["172.104.241.98/32"],

"Description": "IPDebrief risk 40"

}

```

---

## ANALYST NOTES

1. Actionable Risk: The IP shows moderate risk (40) with documented DNSBL presence. While not flagged as a known attacker, the threat feed listings warrant traffic filtering.

2. Cloud Context: As a Linode instance, the IP represents cloud infrastructure which may indicate compromised customer hosting, legitimate research use, or other benign purposes.

3. Neighborhood Correlation: The /24 subnet shows 50% abuse density with one threat sibling (172.104.241.92). Consider evaluating the broader subnet if this IP is involved in an incident.

4. No Active Services: With no open ports detected, the instance appears to be firewalled, reducing immediate exploitation risk but maintaining potential as a command-and-control endpoint.

5. Monitoring Priority: Medium priority for ongoing monitoring due to DNSBL listings and neighborhood abuse density.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.