74.248.36.12📋 Copy

IP INTELLIGENCE BRIEFING: 74.248.36.12/32

Classification: Moderate Risk (Score: 40) | Date: 2026-06-18

---

SUMMARY

IP address 74.248.36.12 is a Microsoft Azure cloud-hosted infrastructure endpoint located in Warsaw, Poland. The address exhibits moderate risk characteristics with minimal active threat indicators. No open services or active scanning behavior detected. Neighborhood analysis indicates the /24 subnet maintains a "mostly_clean" classification despite the presence of 2 threat-adjacent siblings.

---

OWNERSHIP & INFRASTRUCTURE

• ASN: 8075 (Microsoft Azure)
• Organization: PFN ADSL CBB
• Network Block: 74.248.32.0/19
• Infrastructure Type: CloudCompute
• Registration RIR: ARIN
• Control Plane Status: Route stability flagged as false; operator score rated "Minimal" (0.1304)

Geolocation: Warsaw, Poland (52.23°N, 21.01°E) with 150km accuracy radius. Geographic consensus validated across multiple sources.

---

THREAT INDICATORS

• Blacklist Status: 0 active blacklist matches
• DNSBL: Listed on 2 of 8 monitored threat feeds
• Threat Indicators: None detected
• Known Campaigns: None
• Tor Exit/Proxy: False
• Spam Source: False

Network Activity:

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: No active services
• Reverse DNS: No PTR records
• Forward Resolution: 0 entries

---

NETWORK CONTEXT & NEIGHBORHOOD

• Subnet: 74.248.36.12/24
• Abuse Density: 1 (low)
• Subnet Classification: mostly_clean
• Active Siblings: 2
• Threat Siblings: 2
• Adjacent IP: 74.248.36.216 (Risk Score: 25, Authority Score: 50)

---

OBSERVATION HISTORY

19 observations recorded across the observation window. Key findings:

• Most recent signals observed 2026-06-18
• Geographic location consistently reported as Warsaw, Poland
• Abuse density maintained at 1 across observations
• No evidence of persistent malicious activity (threat persistence days: 0)

---

RELATIONSHIP ANALYSIS

21 relationship entities identified, all mapping to the network BLS-74-248-32-0-1003020949. No cross-network associations detected.

---

RECOMMENDED ACTIONS

Based on risk score 40, the following controls are recommended for defensive hardening:

Firewall Blocking:

• iptables: `iptables -A INPUT -s 74.248.36.12 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 74.248.36.12 drop`
• nginx: `deny 74.248.36.12;`

WAF/Cloud Security:

• Cloudflare WAF: Block 74.248.36.12 with IPDebrief risk score 40
• AWS WAF: Block address 74.248.36.12/32

Assessment: While the IP exhibits moderate risk characteristics and DNSBL listings, the absence of open services and the cloud-hosted nature of the infrastructure suggest limited direct threat exposure. Consider blocking at perimeter boundaries as a precautionary measure.

---

INTELLIGENCE CONFIDENCE: High (19 observation signals, multiple data sources validated)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.