79.164.45.143📋 Copy

# IP Intelligence Briefing: 79.164.45.143/32

Classification: Moderate Risk

Report Date: Current

Risk Score: 40/100

Geolocation: RU (Moscow Oblast, Mytishchi)

ASN: 8615 (Neo-CNT)

Organization: Alexey A Petrov

---

## Executive Summary

IP address 79.164.45.143 presents a moderate risk profile (score: 40) with no active threat indicators. The IP is classified as firewalled with no open services detected. While currently clean, the IP is listed on 2 of 8 DNSBLs, suggesting prior reputation issues. Recommended mitigation includes blocking traffic at the perimeter firewall level.

---

## Ownership & Network Profile

• ASN: 8615
• Organization: Alexey A Petrov (Neo-CNT)
• CIDR Block: 79.164.32.0/19
• RIR: RIPE
• Abuse Contact: abuse@cnt.ru (Available via RDAP)
• BGP Prefix: 79.164.0.0/16
• Route Stability: False (indicates potential BGP instability)

---

## Threat Assessment

Current Status: No active threat indicators detected

Threat Indicators:

• Not a Tor exit node
• Not classified as known attacker
• Not a spam source
• Blacklist count: 0
• Abuse confidence score: Unavailable

DNSBL Exposure: Listed on 2 of 8 monitored blacklists (dnsblListedCount: 2)

Control Plane Indicators:

• Operator Score: 0.1304 (Minimal risk)
• DNSSEC Valid: True
• RPKI State: Unknown
• IRR Consistency: Unknown

---

## Network Role Classification

• Infrastructure Type: Firewalled / No Services
• Connection Type: Not detected
• Service Categories:

- Cloud: No

- CDN: No

- VPN: No

- Proxy: No

- Tor: No

- Hosting: No

- Mobile: No

- Residential: No

- Bogon: No

- Anycast: No

---

## DNS Analysis

• PTR Hostname: host-79-164-45-143.qwerty.ru
• Forward Resolution: Unconfirmed
• Domain: qwerty.ru
• Hosted Domains: 0
• Email Authentication: SPF: Yes, DMARC: Yes

---

## Neighborhood Analysis (79.164.45.0/24)

• Abuse Density: 0%
• Classification: Clean
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• High/Medium/Low Risk Neighbors: 0/0/0

The subnet demonstrates a clean profile with no sibling IPs showing threat activity.

---

## Observation History

Total observations: 15

• Recent Signals: Ownership and geolocation data consistently reported
• Ownership Changes: 0
• Threat Persistence Days: 0
• Observation Count: 0
• Persistently Malicious: No

History indicates stable ownership attribution with no persistent malicious behavior detected.

---

## Relationship Graph

• Network Association: Neo-CNT (Same Network)
• DNS Associations: host-79-164-45-143.qwerty.ru (x2)
• Related Entities: 3 total relationships identified

---

## Recommended Security Actions

---

## Operational Notes

• Traceroute: 30 hops, 29 timed out (indicates potential routing issues or firewalled responses)
• GeoValidation: GeoPlausible: False (geolocation data may be unreliable)
• Campaign Correlation: No matching campaigns or certificate subjects identified

---

Assessment: The IP address shows moderate risk due to DNSBL listings and route instability, but lacks active threat indicators. Blocking is recommended as a precautionary measure. Monitor for changes in threat posture or neighborhood activity.

Status: Monitor / Block at perimeter

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.