45.117.104.205📋 Copy

# IP Intelligence Briefing: 45.117.104.205/32

Classification: Moderate Risk (Score: 40/100)

Date of Analysis: 2026-07-23

Intel Source: IPDebrief Threat Intelligence Platform

## Executive Summary

IP 45.117.104.205 is a static residential/business endpoint (ebonenet.com) with moderate risk exposure. The address exhibits conflicting geolocation signals, limited threat persistence, and has been flagged on DNSBL infrastructure despite showing zero open services. Recommended for defensive filtering.

## Ownership & Network Infrastructure

Network Classification: Infrastructure endpoint with no active services detected. Port scanning indicates firewalled/no services. No TLS certificates or HTTP endpoints observed.

## Geolocation Analysis

Conflicting geolocation data detected across multiple sources:

• Primary Profile: GB (London, Europe/London timezone)
• Threat Feeds: Pakistan (latitude 30, longitude 70)

This discrepancy warrants attention during incident correlation. Multiple geo-source validations returned inconsistent consensus.

## Threat Indicators

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Not explicitly scored in profile
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 2 of 8 total lists flagged with maximum severity: high
• Threat Observation Count: 1
• Threat Persistence Days: 0
• Persistently Malicious: False

## Observation History (18 Signals)

Recent activity includes:

• 2026-07-23 13:16:07: Threat indicator from Alienvault OTX (pulse count: 1)
• 2026-07-23 13:15:32: Geolocation signal from MaxMind Geolite2 (country: PK)
• 2026-07-23 13:15:24: DNSBL listings confirmed (8 total lists, 2 active with high severity)
• 2026-07-23 13:15:21: Domain association confirmed (ebonenet.com)

## Neighborhood Assessment

No sibling IPs detected in the /24 subnet with elevated risk profiles.

## Relationship Graph

• Same Network: SNFIBER (multiple associations)
• DNS Associations: static-205-104-117-45.ebonenet.com

No organizational or certificate relationships beyond network and DNS associations.

## Recommended Defensive Actions

Firewall Rules (High Confidence):

```bash

# iptables

iptables -A INPUT -s 45.117.104.205 -j DROP

# nftables

nft add rule inet filter input ip saddr 45.117.104.205 drop

# nginx

deny 45.117.104.205;

# pfSense

45.117.104.205/32

# Cloudflare WAF

{"description":"Block 45.117.104.205 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 45.117.104.205"}}

# AWS WAF

{"Addresses":["45.117.104.205/32"],"Description":"IPDebrief risk 40"}

```

## Analyst Notes

1. Geolocation Discrepancy: The conflict between GB and PK geolocation signals requires correlation with other telemetry before definitive geolocation assignment.

2. Limited Service Exposure: No open ports or active services detected suggests this endpoint may be used for outbound-only communication or is intentionally hardened.

3. DNSBL Presence: Despite zero blacklist count in the primary profile, DNSBL evidence shows 2 high-severity listings across 8 total lists. This warrants monitoring.

4. Moderate Risk Profile: Risk score of 40 indicates the IP warrants defensive filtering but does not represent an immediate, high-severity threat.

5. Static Endpoint: The ebonenet.com PTR hostname suggests this is a residential or static business IP rather than a dynamic or datacenter endpoint.

Recommendation: Implement firewall blocking per rules above. Monitor for continued threat feed activity and geolocation consistency. Re-evaluate if this IP begins showing increased threat signals or service exposure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.