43.134.25.139📋 Copy

Threat Intelligence Briefing: IP 43.134.25.139/32

Overview

• Risk Profile: Moderate risk (40/100), with no active threat indicators or known malicious campaigns.
• Ownership: Owned by IRT-ACEVILLEPTELTD-SG (AS132203), registered to Singapore (SG).
• Geolocation: Located in Singapore (latitude 1.35, longitude 103.82).
• Network Role: Single-service host running SSH (port 22). No CDN, cloud, or residential indicators.

Threat Indicators

• No detected malware, phishing, or spam activity.
• No DNS-based threats, blacklists, or Tor exit node associations.
• SSH service open, but no brute-force or exploit attempts observed.

Observation History (Last 24 Hours)

• Scan Activity: Detected scanning of ports 22 (SSH) with low-confidence (30%) and moderate-confidence (90%) signals.
• Geolocation Discrepancy: One observation incorrectly flagged the IP as U.S.-based; geolocation data confirms Singapore. Verify data source reliability.
• Network Stability: BGP route stability score indicates potential instability (routeChanges30d: 0, isRouteStable: false).

Relationships & Network Context

• Subnet: 43.134.25.139/24, classified as "mostly_clean" with low abuse density (0.6667).
• Neighbors:

- 43.134.25.105 (riskScore: 25, authorityScore: 50)

- 43.134.25.249 (riskScore: 25, authorityScore: 50)

• Shared Network: Linked to "ACE-SG" network, likely a misclassification or shorthand for a broader subnet.

Actionable Insights

1. Monitor SSH Activity: While SSH is legitimate, ensure strong authentication (e.g., key-based) and restrict access to trusted sources.

2. Verify Geolocation Accuracy: Investigate the conflicting U.S. location signal to avoid false positives.

3. Subnet Risk Assessment: The /24 subnet has 3 IPs, 2 with medium risk. Prioritize monitoring neighbors for anomalies.

4. Route Stability: Check BGP configurations for route stability issues, especially given the "mostly_clean" classification.

Conclusion

This IP appears to be a low-risk, single-service host with no immediate malicious activity. However, the geolocation discrepancy and subnet risk profile warrant further investigation to rule out misconfigurations or false positives. SOC teams should focus on SSH security and subnet-level monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.