45.156.87.162📋 Copy

# INTELLIGENCE BRIEFING: 45.156.87.162/32

Classification: Moderate Risk | Date: 2026-07-23 | Priority: Medium-High

---

## EXECUTIVE SUMMARY

IP address 45.156.87.162 presents a moderate risk profile with a risk score of 65/100. The address is part of the 45.156.87.0/24 subnet operated by TechTies-Inc (ASN 197170). The subnet exhibits mixed abuse characteristics with an abuse density of 11.4%, indicating 10 threat-sibling IPs among 22 active siblings. The target IP shows no open services but has been DNSBL-listed on 3 of 8 threat feeds.

---

## TECHNICAL PROFILE

---

## THREAT INDICATORS

• Known Attacker: No | Tor Exit Node: No | Spam Source: No
• Campaign Correlation: No active campaigns detected
• Certificate Matches: 0 | Banner Matches: 0
• Threat Feeds: No specific threat indicators identified

---

## NEIGHBORHOOD ANALYSIS

The 45.156.87.0/24 subnet contains 36 sibling IPs with the following risk distribution:

• High Risk (80+): 4 IPs (45.156.87.34, 45.156.87.147, 45.156.87.165, 45.156.87.234)
• Medium-High Risk (65): 10 IPs including target (45.156.87.162, 45.156.87.13, 45.156.87.93, 45.156.87.166, 45.156.87.182, 45.156.87.204, 45.156.87.216, 45.156.87.253, 45.156.87.254)
• Low Risk (<65): 19 IPs

Subnet Classification: Mixed abuse profile. Target IP shares network infrastructure with multiple high-risk neighbors, suggesting potential for coordinated abuse or misconfigured infrastructure.

---

## OBSERVATION HISTORY

Recent monitoring indicates:

• SSH Service Detected: OpenSSH 9.6p1 Ubuntu-3ubuntu13.15 observed (confidence: 90%)
• Geolocation Signals: Confirmed Netherlands origin (confidence: 52%)
• Registration Signals: ARIN-registered to TechTies-Inc (confidence: 95%)
• Blacklist Activity: 3 DNSBL listings detected with maximum severity: "high"
• Persistence: Single threat observation recorded; not persistently malicious

---

## NETWORK TRAFFIC CHARACTERISTICS

• Traceroute: 14 hops, 4 timed out, transit networks include Comcast
• Route Stability: False (route changes detected)
• BGP Prefix: 45.156.87.0/24
• RTT: 0.1ms (first hop) to 115.2ms (last hop)

---

## RECOMMENDED ACTIONS

Immediate Actions:

1. Logging Enhancement: Increase logging verbosity for all traffic from this IP

2. Ingress Filtering: Block at perimeter firewall

3. Subnet Monitoring: Monitor adjacent high-risk IPs for correlated activity

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 45.156.87.162 -j DROP

# nftables

nft add rule inet filter input ip saddr 45.156.87.162 drop

# Cloudflare WAF

ip.src eq 45.156.87.162 → BLOCK

```

---

## ANALYST NOTES

The target IP (45.156.87.162) shows no active services but maintains a moderate risk profile due to subnet-level abuse characteristics. The presence of 4 high-risk neighbors within the same /24 suggests this infrastructure may be misconfigured or shared with malicious actors. Recommend blocking at perimeter level while maintaining observation for pattern correlation. No immediate threat indicators (TOR, spam, known campaigns) detected, but DNSBL listings warrant continued monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.