172.105.23.240📋 Copy

# IP Intelligence Briefing: 172.105.23.240

Classification: Moderate Risk (Score: 50) | Infrastructure: Cloud Compute (Linode) | Country: Canada (Toronto, ON)

---

## Executive Summary

IP 172.105.23.240 is a Linode cloud infrastructure address with moderate risk scoring primarily attributed to DNSBL listings. The IP resolves to binaryedge.ninja infrastructure and shows no active threat indicators, known campaigns, or malicious activity patterns.

---

## Infrastructure Profile

• Provider: Linode (ASN 63949)
• Network: 172.104.0.0/16
• Geolocation: Toronto, Ontario, Canada
• Infrastructure Type: CloudCompute / Cloud Hosting
• Service Status: Firewalled / No Services Open

---

## Threat Assessment

Risk Score: 50 (Moderate)

Threat Indicators:

• No known attack campaigns
• No identified attacker profiles
• No spam source classification
• No Tor exit node activity

Reputation Sources: DNSBL listed on 2 of 8 total blacklists

---

## Network Context & Neighborhood Analysis

Subnet Classification: Clean (172.105.23.0/24)

• Abuse Density: 0
• Active Siblings: 5 of 6 total
• Threat Siblings: 0

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 0
• Low Risk: 5 (Risk scores: 20-25)

The /24 subnet demonstrates clean characteristics with no associated threat activity.

---

## Observations & History

• Total Signals: 18 observations recorded
• Threat Persistence: 0 days (no persistent malicious behavior)
• Ownership Changes: 0
• Recent Activity: Multiple geolocation and traceroute observations from 2026-07-31 indicating network routing through Comcast infrastructure

---

## DNS Intelligence

• PTR Record: prod-fluorine-ca-central-3.li.binaryedge.ninja
• Forward Resolution: Confirmed to binaryedge.ninja domain
• Forward Hostnames: 1 (prod-fluorine-ca-central-3.li.binaryedge.ninja)
• DNSSEC: Valid
• Email Auth: SPF enabled, DMARC not configured

---

## Recommended Actions

Current Status: Monitor but no immediate blocking recommended.

Suggested Firewall Rules:

• No blocking required; IP operates within legitimate cloud infrastructure parameters
• Monitor for changes in DNSBL status or emergence of threat indicators
• Review binaryedge.ninja service legitimacy if unfamiliar with the infrastructure

---

Conclusion: This IP represents legitimate cloud infrastructure hosting. The moderate risk score derives from DNSBL presence rather than observed malicious behavior. No immediate threat mitigation actions required. Continue monitoring for changes in reputation or threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.