172.245.106.112📋 Copy

# IP Intelligence Briefing: 172.245.106.112

## Executive Summary

The IP address 172.245.106.112 presents a Moderate Risk profile (risk score: 50) with no active malicious indicators. The address is assigned to RackNerd LLC and is classified as firewalled with no active services. Historical observation indicates stable ownership with no persistent malicious behavior.

---

## Ownership and Network Classification

---

## Threat Assessment

Current Risk Level: Moderate (50/100)

The IP shows no evidence of active malicious activity. DNSBL listings (2 out of 8) indicate historical or minor reputation issues but no current blacklist presence.

---

## Technical Observations

• Open Ports: None detected
• TLS Certificates: None
• HTTP Title: None
• PTR Hostname: founded-f68-intel.boogergrapes.net
• DNS Forward Resolution: 1 hostname (boogergrapes.net)
• Email Authentication: No SPF or DMARC records

---

## Neighborhood Analysis

Subnet: 172.245.106.112/24

• Abuse Density: 0 (Clean)
• Total Siblings: 4
• Active Siblings: 2
• Threat Siblings: 0

Neighbor Risk Scores:

The /24 subnet demonstrates low abuse density with no high-risk neighbors. All neighbor IPs show authority scores of 50, indicating legitimate infrastructure.

---

## Observation History

Total Observations: 20 signals collected

Recent Activity (2026-07-30):

• 10:29:50 – Banner/campaign scan (confidence: 0.30)
• 10:24:37 – Port scan with nested data (confidence: 0.70)
• 10:22:41 – Subnet classification: clean (confidence: 0.40)
• 10:22:30 – Ownership stability check (confidence: 0.85)
• 10:22:15 – Network type classification (confidence: 0.30)

Temporal Indicators:

• Ownership Changes: 0
• Threat Observation Count: 0
• Threat Persistence Days: 0
• Assessment: IP is not persistently malicious

---

## Relationship Graph

• 10 total relationships identified
• Network Associations: Multiple entries for CC-172-245-106-0-27
• DNS Associations: 5 entries to founded-f68-intel.boogergrapes.net
• Organizational Links: None beyond RackNerd LLC

---

## Control Plane Data

• Origin ASN: 36352
• BGP Prefix: 172.245.106.0/23
• Route Stability: False
• Route Changes (30d): 0
• MOAS: False
• RPKI State: Not validated
• Delegation Age: Not available

---

## Geographic Validation

*Note: Geographic data shows RTT violation, suggesting potential geolocation inaccuracies.*

---

## Recommended Actions

No specific firewall rules or mitigation actions are recommended at this time. The IP presents no active threat indicators and demonstrates stable, legitimate infrastructure characteristics.

Monitoring Recommendation: Continue passive observation. No immediate defensive actions required.

---

## Threat Intelligence Narrative

IP 172.245.106.112 is a firewalled address under RackNerd LLC's infrastructure with moderate baseline risk. The absence of open services, combined with clean neighborhood metrics and zero persistent malicious behavior, indicates this IP serves benign network functions. While 2 DNSBL listings suggest historical minor reputation issues, current threat feeds show no active malicious activity. The geographic validation discrepancy warrants awareness but does not indicate compromise. SOC analysts should monitor for any changes in service status or threat indicators, but no immediate defensive measures are warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.