78.73.228.61📋 Copy

# IP Intelligence Briefing: 78.73.228.61

Date: 2026-07-28

IP Address: 78.73.228.61

Risk Level: Moderate (55/100)

## Executive Summary

The IP address 78.73.228.61 is registered to Telia Company AB (ASN 3301, TELIANET) and is geolocated to Sweden. The IP operates on mobile infrastructure (Telia LTE/5G) and is classified as a single-service host with SSH (port 22) open. The address is listed on 3 of 8 DNSBL sources, though no known attacker campaigns or persistent malicious activity was detected.

## Ownership and Infrastructure

## Threat Indicators

• Risk Score: 55/100
• Abuse Confidence Score: Not available
• Blacklist Count: 3 (of 8 total DNSBL lists checked)
• Known Campaigns: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

The control plane data shows the IP is not a MOAS (Multi-Origin Asn Service) and has stable routing. DNSBL listing count indicates elevated scrutiny but not definitive malicious classification.

## Network Environment

• Subnet Classification: Clean
• Abuse Density: 0 (no abuse in /24)
• Threat Siblings: 0
• Neighboring IPs: 0 active siblings in 78.73.228.0/24

The neighborhood analysis indicates this IP exists in isolation within its subnet with no correlated malicious activity from adjacent addresses.

## Observed Services

• Port 22/TCP: SSH service open
• TLS Certificates: None detected
• HTTP/HTTPS: No web services identified
• DNS Resolution: 78-73-228-61-no2664.tbcn.telia.com (forward confirmed)

## Historical Activity

22 observations were recorded across the observation window. Analysis shows:

• RTT validation confirms plausible geolocation (121.4ms average)
• No persistent malicious activity detected
• Ownership stability: No changes recorded
• Threat observation count: 0

## Recommended Actions

Immediate

```bash

# iptables

iptables -A INPUT -s 78.73.228.61 -j DROP

# nftables

nft add rule inet filter input ip saddr 78.73.228.61 drop

# Cloudflare WAF

filter: ip.src eq 78.73.228.61

action: block

```

Monitoring

Increase logging verbosity and review recent activity from this IP. The elevated risk score (55/100) warrants enhanced monitoring despite the clean neighborhood classification.

## Assessment

This IP operates on legitimate Telia mobile infrastructure but is flagged by multiple DNSBL sources. The moderate risk score reflects the blacklist presence and mobile carrier association. No direct evidence of malicious activity was observed, but the IP should be blocked at the perimeter with enhanced logging for correlation with other security signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.