212.104.118.61📋 Copy

# IP INTELLIGENCE BRIEFING: 212.104.118.61

Target: 212.104.118.61/32

Classification: Moderate Risk (Score: 50)

Jurisdiction: Bulgaria (BG) – Sofia

ISP/Network: A1-Razgrad (ASN: 12716, RIR: RIPE)

CIDR Block: 212.104.112.0/20

Registration: 212.104.118.61/24 subnet

## Summary Assessment

IP 212.104.118.61 is a Bulgarian residential/enterprise endpoint with a moderate risk profile (50/100). The IP exhibits no active threat indicators, is not blacklisted by major feeds, and shows no evidence of malicious campaign participation. The network environment is classified as "clean" with minimal abuse density.

## Threat Profile

• Risk Score: 50 (Moderate Risk)
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Operator Score: 0.1304 (Minimal)

## Network & Infrastructure

• ASN: 12716 (AS13124-MNT)
• Organization: A1-Razgrad
• RIR: RIPE
• Geolocation: Sofia, Bulgaria (42.73°N, 25.49°E)
• Network Role: Firewalled / No Services
• DNS PTR: unknown.blizoo.bg
• Forward Resolution: unconfirmed

## Neighborhood Analysis

• Subnet: 212.104.118.0/24
• Abuse Density: 0 (clean)
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 0
• Neighbor IP: 212.104.118.35 (Risk Score: 15, Authority Score: 50)

Assessment: The /24 subnet shows no inherited risk from neighboring IPs. Both siblings are active and classified as low-risk.

## Historical Observations

Analysis of 16 historical observations reveals stable characteristics:

• No ownership changes detected
• No persistently malicious behavior
• No threat observation count anomalies
• Recent classification remains "clean" with zero abuse density
• ASN and geolocation data consistent across observation window

## Related Entities

• Network: A1-Razgrad (multiple associations)
• DNS Hostname: unknown.blizoo.bg (DNS associations present)

## Recommended Actions

Based on risk profile and threat indicators, no immediate blocking action is recommended. The IP presents as a standard Bulgarian endpoint with no active malicious activity.

Firewall Policy: Allow or monitor based on organizational policy. No specific block rules required.

SOC Analyst Notes:

• Monitor for any change in risk score or emergence of threat indicators
• No immediate threat; IP is classified as clean with moderate baseline risk
• No correlation to known campaigns or coordinated threats
• Network reputation stable; no rapid escalation patterns observed

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.