45.156.87.165📋 Copy

## THREAT INTELLIGENCE BRIEFING

Target IP: 45.156.87.165/32

Classification: HIGH RISK (Score: 80/100)

Date: 2026-07-22

---

EXECUTIVE SUMMARY

IP 45.156.87.165 is a high-risk web server endpoint located in the Netherlands (Eygelshoven, Limburg) operating under ASN 197170 (TechTies-Inc). The IP presents elevated security concerns due to its High Risk classification, presence on 4 out of 8 DNSBL lists with at least one "high" severity listing, and exposure of administrative services including RDP (3389) and SSH (22).

---

NETWORK OWNERSHIP & GEOLOCATION

• Organization: TechTies-Inc (mnt-nl-skylink2-1)
• ASN: 197170
• CIDR Block: 45.156.87.0/24
• RIR: ARIN
• Registered Country: NL (Netherlands)
• Region/City: Limburg, Eygelshoven
• Geo Validation: False (plausibility mismatch detected)
• Route Stability: False (BGP route instability observed)

---

SERVICE EXPOSURE ANALYSIS

Open Ports Detected:

TLS/Certificate Status: No valid TLS certificate detected

Reverse DNS: None configured

Email Authentication: SPF/DMARC not configured

---

THREAT INDICATORS

• DNSBL Listings: 4/8 total lists (confirmed)
• Threat Persistence Days: 0
• Known Campaigns: None correlated
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Threat Feeds: Empty

Historical Signals: 47 observations recorded. One observation (2026-07-22 07:18:44) flagged DNSBL listings with "high" severity across multiple blacklist sources.

---

SUBNET CONTEXT (45.156.87.0/24)

• Abuse Density: 0.086 (elevated)
• Total Siblings: 36
• Active Siblings: 21
• Threat Siblings: 9
• Classification: Mixed
• Inherited Risk Score: 10

Notable High-Risk Neighbors (Risk Score ≥65):

• 45.156.87.34 (80)
• 45.156.87.147 (80)
• 45.156.87.234 (80)
• 45.156.87.13, 45.156.87.93, 45.156.87.166, 45.156.87.178, 45.156.87.182, 45.156.87.204, 45.156.87.216, 45.156.87.253, 45.156.87.254 (all 65)

---

CONTROL PLANE DATA

• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated
• IRR Consistency: Not validated
• Route Changes (30d): 0
• DNSSEC: Valid
• CAA Records: Not present

---

RELATIONSHIP GRAPH

27 relationships identified, all mapping to the same network entity "TechTies-Inc". No external hostnames, certificates, or organizational links detected.

---

RECOMMENDED ACTIONS

1. Block Inbound RDP: Implement firewall rule to deny inbound TCP/3389 to 45.156.87.165/32. RDP exposure with no TLS certificate presents critical attack surface.

2. Monitor SSH Traffic: Review TCP/22 traffic patterns for brute-force or lateral movement indicators.

3. DNSBL Investigation: Investigate why the IP is listed on 4 DNSBL feeds. Request delisting from authoritative sources after remediation.

4. Subnet-wide Assessment: Evaluate all 35 sibling IPs in /24, particularly the 11 neighbors with Risk Score ≥65. Consider blocking or monitoring the high-risk subset.

5. Route Verification: Validate BGP route stability and operator controls given the isRouteStable flag.

---

RISK RATING

Overall: HIGH (80/100)

Primary Concerns: DNSBL presence, RDP service exposure, subnet abuse density, route instability

Recommendation: Block at perimeter firewall, monitor for lateral activity, investigate DNSBL listings, assess subnet for coordinated abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.