45.79.181.251📋 Copy

IP Intelligence Briefing: 45.79.181.251

Date: 2026-06-07

---

**Core Profile**

• Risk Score: 40 (Moderate Risk)
• Provider: Linode (ASN 63949)
• Geolocation: Claimed NJ, US (Cedar Knolls), but RTT anomaly indicates plausible spoofing (observed RTT: 20ms vs. expected 119.8ms for 5989km).
• Network Role: CloudCompute (Linode infrastructure), no open ports or services detected.
• Threat Indicators: No malicious activity, no blacklists, no known campaigns, or DNS anomalies.

---

**Observation History**

• Last Scan: 2026-05-31 (ports scanned, no active services identified).
• RTT Anomalies: Persistent misalignment between geographic claims and network latency, suggesting potential spoofing or misconfigured routing.
• DNS Associations: Linked to `guernsey.scan.bufferover.run` (no known malicious history).

---

**Network Relationships**

• Subnet: 45.79.181.251/24
• Neighbors:

- 45.79.181.94 (Risk: 55)

- 45.79.181.104 (Risk: 55)

- Subnet abuse density: 0.6667 (mostly clean, but 2 high-risk neighbors).

• Shared Network: Linode (ASN 63949), no CDN/VPN/Proxy detected.

---

**Key Findings**

1. Low Direct Threat: No malicious indicators, but moderate risk due to network neighbors.

2. Geolocation Discrepancy: RTT data contradicts claimed location, warranting further verification.

3. DNS Context: Tied to `bufferover.run`, which appears benign but requires monitoring for unexpected behavior.

---

**Recommendations**

• Monitor Neighbors: Focus on 45.79.181.94 and 45.79.181.104 for potential lateral movement.
• Validate Geolocation: Investigate RTT anomalies to confirm IP legitimacy.
• Check DNS Behavior: Ensure `guernsey.scan.bufferover.run` is not repurposed for malicious activity.
• Maintain Baseline: No immediate mitigation needed, but continuous monitoring advised.

SOC Action: No immediate blocking recommended. Prioritize investigation into subnet neighbors and DNS ties.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.