45.79.190.74📋 Copy

# IP Intelligence Briefing: 45.79.190.74/32

## Executive Summary

IP address 45.79.190.74 is a Linode cloud infrastructure endpoint with a moderate risk score of 40. The IP shows no direct threat indicators but operates within a subnet exhibiting elevated abuse density (0.6667). Recommended action is defensive monitoring or blocking pending correlation with other security signals.

## Risk Assessment

• Risk Score: 40/100 (Moderate Risk)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence: Not assessed
• Classification: Hosting/Cloud infrastructure

## Ownership and Infrastructure

• Organization: Linode
• ASN: 63949 (AKAMAI-LINODE-AP - Akamai Connected Cloud)
• Geolocation: United States, New Jersey, Cedar Knolls
• Infrastructure Type: CloudCompute
• DNS: 45-79-190-74.ip.linodeusercontent.com
• PTR Record: Forward resolution confirmed

## Network Context

The IP resides in subnet 45.79.190.74/24 with the following characteristics:

• Abuse Density: 0.6667 (High)
• Active Siblings: 2 IPs detected
• Threat Siblings: 2 IPs flagged as threats
• Neighbor Risk Scores: 45.79.190.95 (40), 45.79.190.104 (40)

## Threat Intelligence

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Feeds: No indicators
• Campaign Matches: None detected

## Anomalies and Observations

• Geolocation Validation Issue: RTT anomaly detected (19ms observed vs. 119.8ms minimum possible for 5,989km distance). This suggests either reporting error or potential proxy/routing anomaly.
• Route Stability: False (control plane indicates instability)
• Open Ports: None detected (Firewalled/No Services)
• TLS Certificates: Not configured

## Historical Analysis

19 observations recorded over the monitoring period. Recent signals consistently identify the IP as Linode cloud infrastructure with no pattern of escalating malicious behavior. No persistent malicious activity detected (threat persistence days: 0).

## Recommended Actions

Based on risk profile, the following defensive measures are recommended:

Firewall Rules:

• `iptables -A INPUT -s 45.79.190.74 -j DROP`
• `nft add rule inet filter input ip saddr 45.79.190.74 drop`
• `nginx: deny 45.79.190.74`

Cloud/WAF Configuration:

• Cloudflare WAF: Block IP with expression `ip.src eq 45.79.190.74`
• AWS WAF: Add 45.79.190.74/32 to block list

## Intelligence Narrative

IP 45.79.190.74 represents a Linode cloud hosting endpoint. While no direct threat indicators are present, the elevated abuse density of the /24 subnet and the presence of 2 threat-sibling IPs warrant defensive attention. The IP shows no services exposed (firewalled configuration), reducing immediate exploitation risk. However, the geolocation validation anomaly and route instability suggest potential misconfiguration or proxy usage. SOC analysts should monitor for any emerging threat indicators in correlation with the flagged sibling IPs (45.79.190.95, 45.79.190.104).

Priority: Monitor

Confidence: Medium

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.