49.124.145.56📋 Copy

# INTELLIGENCE BRIEFING: IP 49.124.145.56/32

Classification: High Risk | Date: 2026-06-23 | Analyst: SOC Intelligence

## EXECUTIVE SUMMARY

IP address 49.124.145.56 belongs to DiGi IP Support (ASN 4818, DIGI-AS-AP) and registers to the 49.124.0.0/15 CIDR block. The IP carries an elevated risk score of 70/100, classifying it as High Risk. The address is geolocated to Shah Alam, Selangor, Malaysia, with one threat observation recorded in the signal history.

## OWNERSHIP AND GEOLOCATION

• Organization: DiGi IP Support (ASN 4818)
• Network: 49.124.0.0/15 (APNIC RIR)
• Country: Malaysia (MY)
• Region: Selangor, Shah Alam
• Coordinates: 4.21° N, 101.98° E
• Geolocation Confidence: Consensus verified across multiple sources

## THREAT PROFILE

• Risk Score: 70/100 (High Risk)
• Abuse Confidence: Not explicitly scored
• Threat Indicators: No active threat indicators or known campaigns detected
• Blacklist Status: Listed on 4 of 8 DNSBLs (dnsblListedCount: 4)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## NETWORK SERVICES AND FINGERPRINT

• Open Ports: None detected
• Service Status: Firewalled / No Services
• TLS Certificate: Not configured
• HTTP Title: Not available
• Server Banner: No response

## OBSERVATION HISTORY

Signal observation history contains 17 recorded observations. Key observations include:

• 2026-06-23 15:05: Geolocation probe reported ICMP blocked with inability to validate; claimed latitude 2.5°, longitude 112.5° (distance: 10,851.1 km from geolocation)
• 2026-06-23 15:04: Operator score rated "Minimal" (0.1304)
• 2026-06-18 11:14: Geolocation inference confirmed Malaysia (4.21° N, 101.98° E) with 400 km accuracy radius
• 2026-06-18 11:11: Operator score rated "Minimal" (0.1304)

## NETWORK NEIGHBORHOOD ANALYSIS

The /24 subnet (49.124.145.56/24) exhibits elevated abuse density:

• Abuse Density Score: 1.0 (High)
• Neighbor Count: 1 active neighbor
• Threat Siblings: 1
• Inherited Risk: 2
• Neighbor IP: 49.124.145.57 (Risk Score: 80/100, Authority Score: 50)

The neighborhood classification is "mostly_clean" despite high abuse density, suggesting mixed legitimate and potentially compromised traffic patterns.

## RELATIONSHIP GRAPH

Relationship analysis returned 17 entries, all indicating "Same Network" relationships to DIGI-AS-AP. No organizational, hostname, or certificate relationships were established beyond the network association.

## RECOMMENDED ACTIONS

Based on risk score 70/100, the following remediation measures are recommended:

Monitoring:

• Increase logging verbosity for all traffic from this IP
• Review recent activity patterns and connection attempts

Firewall Implementation:

• iptables: `iptables -A INPUT -s 49.124.145.56 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 49.124.145.56 drop`
• nginx: `deny 49.124.145.56;`
• pfSense: Block 49.124.145.56/32
• Cloudflare WAF: Block via expression `ip.src eq 49.124.145.56`
• AWS WAF: Add 49.124.145.56/32 to block list

Contextual Note: The neighbor IP 49.124.145.57 carries an elevated risk score of 80/100. Consider evaluating the broader /24 subnet (49.124.145.0/24) for additional threat correlation.

---

*Intelligence generated by IPDebrief. These recommendations are probabilistic and should be combined with other signals before taking action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.