172.105.118.173📋 Copy

# IP Intelligence Briefing: 172.105.118.173

Classification: Low Risk Cloud Infrastructure IP

Report Date: 2026-08-13

Analyst: IPDebrief Intelligence Unit

## Executive Summary

IP 172.105.118.173 is a low-risk cloud computing address associated with Linode (ASN 63949) in Singapore. The IP maintains a risk score of 25 with no active threat indicators, blacklist associations, or malicious activity. The address represents standard cloud infrastructure with an open SSH service and no evidence of abuse or compromise.

## Technical Profile

• Organization: Linode (ASN 63949)
• Network: 172.104.0.0/16
• Geolocation: Singapore (SG)
• Infrastructure Type: CloudCompute / Hosting
• DNS: 172-105-118-173.ip.linodeusercontent.com (forward confirmed)
• Open Services: TCP/22 (SSH - OpenSSH_9.9)
• TLS/HTTP: No active services detected

## Threat Assessment

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable
• Blacklist Status: 0/0 (no blacklist associations)
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False

## Control Plane & Routing

• BGP Prefix: 172.105.112.0/20
• Route Stability: Unstable
• DNSSEC: Valid
• DNSBL: Listed on 1 of 8 checks (minor concern)
• Operator Score: 0.2609 (Basic)

## Neighborhood Analysis

• Subnet: 172.105.118.0/24
• Abuse Density: 0.0 (Clean)
• Active Threat Siblings: 0
• Total Siblings: 1
• Classification: Clean

## Historical Activity

• Total Observations: 26
• Recent Activity: 2026-08-13
• Threat Persistence: None detected
• Ownership Changes: 0
• Campaign Likelihood: None

## Intelligence Narrative

The IP address 172.105.118.173 represents standard Linode cloud infrastructure with no evidence of malicious activity. The single open SSH port is consistent with cloud hosting services. Geolocation data indicates Singapore-based hosting with plausible routing through NTT backbone networks. The subnet shows zero abuse density, and no neighboring IPs present threat indicators. DNS records resolve correctly with forward confirmation. One minor DNSBL listing exists but does not indicate active abuse.

## Recommendations for SOC Analysts

1. Block Decision: No immediate block required - low risk profile

2. Monitoring: Standard cloud infrastructure monitoring applies

3. Connection Policy: Allow established SSH connections from authorized sources only

4. Threat Hunting: No active threat indicators warrant investigation

5. Whitelist Consideration: May be added to allowlist for Linode traffic if needed

## Actionable Firewall Rules

No immediate blocking rules recommended. Standard egress/ingress policies for cloud infrastructure apply.

Status: MONITOR - No action required

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.