172.236.127.133📋 Copy

## IP Intelligence Briefing: 172.236.127.133

Executive Summary

IP address 172.236.127.133 is associated with Linode cloud infrastructure (ASN 63949) in Chicago, IL. The IP carries a moderate risk score of 55/100 with no confirmed threat indicators. Infrastructure shows firewalled status with no open services detected. Recommended action: Monitor or consider blocking based on organizational threat posture.

---

Infrastructure Profile

• Organization: Linode (LINODE)
• ASN: 63949
• Network Block: 172.232.0.0/13
• Classification: Cloud Compute / Hosting
• Geolocation: United States, Chicago, IL
• DNS: 172-236-127-133.ip.linodeusercontent.com
• Service Status: Firewalled / No Services (no open ports detected)

Risk Assessment

• Overall Risk Score: 55/100 (Moderate Risk)
• Abuse Confidence: Not scored
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• DNSBL Listings: 3 of 8 total lists
• Threat Persistence: 0 days observed
• Persistently Malicious: False

Neighborhood Analysis

• Subnet: 172.236.127.133/24
• Abuse Density: Low (1/256)
• Subnet Classification: Mostly Clean
• Threat Siblings: 1
• Active Siblings: 1
• Inherited Risk: 2/100

Control Plane Observations

• Route Stability: Unstable
• Operator Score: 0.2609 (Basic)
• RPKI State: Not evaluated
• IR Consistency: Not evaluated
• Route Changes (30d): 0

Temporal Indicators

• Observation Count: 24 historical observations
• Latest Signal: 2026-06-29T03:55:14
• Ownership Changes: 0
• Threat Observation Count: 1

Relationship Graph

• Primary Associations: DNS associations to Linode infrastructure
• Network Relationships: Same network (LINODE)
• Related Hostnames: 172-236-127-133.ip.linodeusercontent.com

Anomalies

• Geolocation Validation: Failed (geoPlausible: false)
• RTT Violation: Observed 34ms RTT vs minimum possible 134.2ms for Chicago, IL location (6,707km distance)

---

Recommended Security Actions

Monitoring:

• Increase logging verbosity and review recent activity from this IP
• Monitor for escalation in risk indicators

Firewall Recommendations:

• iptables: `iptables -A INPUT -s 172.236.127.133 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 172.236.127.133 drop`
• nginx: `deny 172.236.127.133;`
• pfSense: Add to block list: `172.236.127.133/32`
• Cloudflare WAF: Block with expression: `ip.src eq 172.236.127.133`
• AWS WAF: Add to deny list: `172.236.127.133/32`

---

Intelligence Narrative

The target IP 172.236.127.133 represents a Linode cloud compute instance with moderate risk characteristics. The IP shows no confirmed malicious activity patterns—no known attacker reputation, no Tor exit node classification, and zero confirmed spam source indicators. The single threat observation recorded shows minimal risk.

However, the moderate risk score (55/100) warrants attention. The IP is part of a subnet with low abuse density (1/256) and mostly-clean classification, though one threat sibling exists in the neighborhood. Geolocation data shows validation failures with RTT anomalies suggesting potential data inaccuracies.

The infrastructure is properly configured with firewalled services and standard DNS resolution for Linode hosting. The route instability flag and 3 DNSBL listings suggest the IP may have transient reputation issues. No persistent malicious behavior has been observed over the 24 observation period.

Decision Point: Given the moderate risk score and cloud hosting nature, implement blocking if the IP is not a known legitimate service. Monitor for activity escalation given the unstable routing status and DNSBL listings.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.