172.235.218.58📋 Copy

# IP Intelligence Briefing: 172.235.218.58/32

Classification: Moderate Risk | Analysis Date: 2026-06-20

Data Sources: IPDebrief Intelligence Platform

## Executive Summary

IP address 172.235.218.58 is a Linode cloud compute infrastructure asset with a moderate risk score of 60/100. The IP shows no confirmed malicious indicators, but exhibits elevated risk relative to baseline infrastructure. No immediate threat indicators identified.

## Ownership and Infrastructure

Network Role: Web server hosting environment with RDP and SSH access exposed. DNS forward confirmed to `172-235-218-58.ip.linodeusercontent.com`. Two hosted domains identified: `itluke999.zeabur.app` and the IP hostname.

## Threat Assessment

• Risk Score: 60/100 (Moderate)
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None correlated
• Threat Persistence: 0 days
• DNSBL Listed: 1 of 8 total lists

The IP shows no evidence of persistent malicious activity or association with active threat campaigns. Operator classification rated "Basic" (score: 0.4348).

## Neighborhood Analysis

Neighbor IPs:

• 172.235.218.59: Risk Score 25 (Low)
• 172.235.218.219: Risk Score 60 (Moderate)

The /24 subnet shows moderate abuse density with 1 threat sibling identified.

## Observed Services

Open RDP (3389) and SSH (22) services present potential lateral movement vectors if compromised.

## Historical Observations

31 total observations recorded. Recent activity (2026-06-20) includes:

• Connection failures on HTTPS endpoint
• Port scanning activity detected
• Network classification signals showing "mostly_clean" status

Route stability confirmed (isRouteStable: true) with zero route changes in 30 days.

## Recommended Actions

Immediate: Increase logging verbosity for this IP and monitor recent activity.

Firewall Rules:

• iptables: `iptables -A INPUT -s 172.235.218.58 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 172.235.218.58 drop`
• Cloudflare WAF: Block rule with expression `ip.src eq 172.235.218.58`
• AWS WAF: Address `172.235.218.58/32`

## Risk Rationale

The IP's moderate risk score stems from infrastructure classification (cloud compute hosting) and elevated risk relative to the subnet's baseline. No direct malicious indicators detected. Correlation with subnet neighbor 172.235.218.219 (identical risk score) suggests potential shared infrastructure risk profile.

Recommendation: Monitor but do not block without additional contextual indicators. Implement enhanced logging and review for any anomalous activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.