198.58.113.47📋 Copy

INTELLECTUAL PROPERTY: IP INTELLIGENCE BRIEFING

Target: 198.58.113.47

Classification: Moderate Risk

Date: 2024-01-XX

---

EXECUTIVE SUMMARY

IP 198.58.113.47 is a Linode cloud infrastructure host (ASN 63949) registered to LINODE in Texas, US. The IP demonstrates moderate risk scoring (50) with no confirmed malicious activity indicators. No active threat campaigns, blacklist listings, or known attacker associations were identified.

---

INFRASTRUCTURE PROFILE

• Organization: Linode (LINODE)
• ASN: 63949
• CIDR Block: 198.58.96.0/19
• Geolocation: Richardson, TX, US (claimed)
• Infrastructure Type: Cloud Compute / Hosting Provider
• DNS Resolution: li615-47.members.linode.com (forward confirmed)
• Email Security: SPF and DMARC records present for domain

---

THREAT INDICATORS

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not available
• Blacklist Count: 0
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Active Threat Feeds: None detected

---

NETWORK OBSERVATIONS

• Open Services: Port 22 (SSH - OpenSSH_10.2p1 Ubuntu-2ubuntu3.5)
• Neighborhood: Subnet 198.58.113.0/24 shows clean classification with 0 abuse density
• Sibling IPs: 2 active siblings in /24 subnet; 1 neighbor (198.58.113.100) with risk score 25
• Control Plane: DNSSEC validated; RTT measurements indicate geolocation inconsistencies (57ms observed vs 159.6ms minimum expected for 7978.6km distance)

---

HISTORY & PERSISTENCE

• Observations: 20 historical signals tracked
• Ownership Stability: No ownership changes recorded
• Threat Persistence: Not persistently malicious
• Recent Activity: SSH service scanning detected; geolocation data shows inconsistencies suggesting potential misconfiguration or spoofing

---

RECOMMENDED ACTIONS

Based on moderate risk classification, the following controls are recommended:

---

ANALYST NOTES

The IP resides in a low-risk subnet but presents moderate risk scoring. The geolocation data contains RTT validation violations, suggesting the claimed Texas location may be inaccurate. SSH service is operational, which is consistent with hosting infrastructure. No active malicious indicators were confirmed. SOC teams should monitor for behavioral changes and correlate with additional intelligence sources before implementing permanent blocking measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.