172.232.104.112📋 Copy

IP Intelligence Briefing: 172.232.104.112

Date: 2026-06-16

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Owner: Linode (ASN 63949)
• Geolocation: Denver, Colorado, US
• Network Role: CloudCompute (Linode infrastructure)
• Threat Indicators: No malicious activity detected.

---

**2. Observational History**

• 15 signals recorded over 30 days:

- DNSBL listings (1 high-severity threat, 0.85 confidence).

- BGP prefix tied to Linode (AS63949).

- DNS records validated (DNSSEC enabled).

- Email reputation shows no SPF/DMArc configuration.

• No persistent threats or campaign correlations.

---

**3. Network Relationships**

• DNS Association: Resolves to `172-232-104-112.ip.linodeusercontent.com` (Linode subdomain).
• Network Link: Shared subnet with Linode’s infrastructure.

---

**4. Neighborhood Analysis**

• Subnet: 172.232.104.0/24
• Neighbor Risk:

- 1 sibling IP (`172.232.104.97`) with riskScore 25 and authorityScore 60.

• Abuse Density: 0% (low risk subnet).

---

**5. Threat Context**

• No known malicious activity detected (no malware, phishing, or C2 indicators).
• DNSBL listing may indicate spam or abuse risk, but low confidence.
• Linode’s infrastructure is generally secure, but cloud instances can be compromised.

---

**6. SOC Recommendations**

1. Monitor DNS traffic for unusual queries or zone transfers.

2. Verify DNSSEC configuration for subdomain (`linodeusercontent.com`).

3. Check neighbor IPs for potential lateral movement risks.

4. Ensure cloud security (e.g., Linode’s firewall rules) are enforced.

---

Conclusion:

This IP is a legitimate Linode cloud instance with no direct threat indicators. However, the DNSBL listing and moderate authority score of a neighbor warrant further investigation into potential abuse or misconfigurations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.