172.105.196.91📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

IP Address: 172.105.196.91/32

Generated: 2026-08-05

Classification: Cloud Infrastructure - Low Risk

---

## EXECUTIVE SUMMARY

IP address 172.105.196.91 is a Linode cloud compute VPS with a low risk profile (Score: 25/100). The IP is associated with legitimate Linode infrastructure, operates standard SSH services, and shows no active threat indicators. Historical data indicates stable ownership with minimal threat activity.

---

## INFRASTRUCTURE PROFILE

---

## THREAT ASSESSMENT

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• Threat Feeds: None

Key Indicators:

• Only open service: SSH (port 22/tcp) with OpenSSH 7.4 banner
• DNS resolution confirmed to Linode members hostname
• Email authentication (SPF/DMARC) configured on parent domain

---

## GEOLOCATION ANALYSIS

• Country: United States
• Region: 13
• City: Tokyo (inferred - likely routing via cloud infrastructure)
• Note: Geographic data shows inconsistency between US registration and Tokyo coordinates, consistent with global cloud routing patterns.

---

## OBSERVATION HISTORY

• Total Observations: 25
• Recent Activity: 2026-08-05
• Threat Persistence: 0 days
• Notable Signals:

- Subnet abuse density: 1 (mostly_clean classification)

- 1 threat sibling detected in /24

- Alienvault OTX signals with 11 pulse matches (nested)

- Operator score: 0.2609 (Basic)

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 172.105.196.91/24
• Abuse Density: 0
• Active Siblings: 0
• Threat Siblings: 0 (inherited from current data snapshot)
• Risk Distribution: Clean subnet classification

---

## RELATIONSHIP GRAPH

• DNS Associations: li1838-91.members.linode.com (multiple records)
• Network Associations: LINODE (multiple records)
• Total Relationships: 15
• No organizational or certificate associations detected

---

## RECOMMENDED ACTIONS

Based on current risk profile (Score: 25), no immediate firewall rules or blocking recommendations are generated. This IP represents legitimate cloud infrastructure.

SOC Analyst Notes:

• Monitor for SSH brute force attempts (standard cloud VPS exposure)
• No evidence of malicious activity or command-and-control behavior
• Historical data shows stable, persistent ownership (Linode)
• Consider whitelisting if this IP is a known legitimate service endpoint

---

## CONCLUSION

172.105.196.91 is classified as a low-risk cloud infrastructure IP with no active threat indicators. The IP operates standard administrative services (SSH) and is associated with Linode's cloud platform. No defensive actions are currently required, though standard SSH monitoring is recommended for all cloud VPS endpoints.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.