45.156.87.12📋 Copy

# IP INTELLIGENCE BRIEFING: 45.156.87.12

Classification: Moderate Risk | Status: Active Monitoring Recommended

## Executive Summary

IP 45.156.87.12 is classified as Moderate Risk with a risk score of 40/100. The address is associated with TechTies-Inc (ASN 197170) and is located in Eygelshoven, Limburg, Netherlands. The IP is currently firewalled with no open services, but exhibits notable neighborhood activity with 7 threat siblings in the /24 subnet.

## Network Profile

## Threat Indicators

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0 (Control plane shows DNSBL listed: 2/8 total lists)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Associations: None detected
• Threat Feeds: No matches

## Neighborhood Analysis (45.156.87.0/24)

The /24 subnet shows elevated activity with 36 total sibling IPs:

• Abuse Density: 19.44%
• Classification: Mostly Clean
• Active Siblings: 23/36
• Threat Siblings: 7
• Risk Distribution: High (4), Medium (13), Low (18)

Notable High-Risk Neighbors:

• 45.156.87.34 (Risk: 80)
• 45.156.87.147 (Risk: 80)
• 45.156.87.165 (Risk: 80)
• 45.156.87.234 (Risk: 80)

## Behavioral Observations

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Route Stability: Unstable (is_route_stable: false)
• RPKI State: Unknown
• DNSSEC Valid: Yes

## Historical Trend

Analysis of 16 signal observations indicates stable characteristics:

• Geolocation: Consistent NL/Limburg/Eygelshoven placement
• Network Classification: Stable (mostly_clean classification maintained)
• Abuse Density: Consistent at ~0.1944 across observations
• Network RTT: 98-107ms average, consistent with claimed location

## Recommended Actions

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 45.156.87.12 -j DROP

# nftables

nft add rule inet filter input ip saddr 45.156.87.12 drop

# nginx

deny 45.156.87.12;

```

WAF Integration:

• Cloudflare WAF: Block with expression `ip.src eq 45.156.87.12`
• AWS WAF: Add 45.156.87.12/32 to block list

## Intelligence Assessment

The target IP shows moderate risk with firewalled status and no active services. However, the 19.44% abuse density in the /24 and presence of 7 threat siblings indicates this may be part of a larger infrastructure. The subnet's mixed risk profile (4 high-risk neighbors) warrants monitoring of the full /24 range. No direct evidence of malicious activity from this specific IP, but neighborhood context suggests elevated threat posture.

Priority: Monitor | Recommended Action: Block at perimeter firewall, monitor subnet activity

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.