87.71.5.165📋 Copy

# INTELLIGENCE BRIEFING: IP 87.71.5.165/32

Classification: High Risk

Date: 2026-06-24

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP 87.71.5.165 is a high-risk single-service host located in Tel Aviv, Israel, operating within ASN 12400. The IP presents an SSH service on port 22 and has been listed on 6 of 8 DNSBLs. While the immediate /24 neighborhood shows low abuse density, the IP itself carries a risk score of 80.

---

## GEOLOCATION & OWNERSHIP

• Country: Israel (IL)
• City: Tel Aviv
• Coordinates: 31.05°N, 34.85°E
• ASN: 12400 (AS9116-MNT)
• RIR: RIPE
• Registration Status: Ownership details available via RDAP

---

## NETWORK CLASSIFICATION

• Role: Single-Service Host
• Provider Score: 0
• Authority Score: 0
• Infrastructure Type: None identified
• Cloud/CDN/VPN: Negative across all categories
• Stability: Route stability flagged as false; route changes observed

---

## THREAT INDICATORS

• Risk Score: 80 (High Risk)
• DNSBL Listings: 6 of 8 total lists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Likelihood: None
• Threat Observation Count: 1

---

## SERVICE FINGERPRINT

• Open Ports: TCP/22 (SSH)
• Banner: SSH-1.99-OpenSSH_5.1
• TLS Certificate: None
• HTTP Services: None detected
• Forward Resolution: Not confirmed

---

## OBSERVATION HISTORY (17 Signals)

Recent observations span June 2026:

---

## NEIGHBORHOOD ANALYSIS (/24: 87.71.5.0/24)

• Abuse Density: 0 (low)
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Risk Distribution: Low (1), Medium (0), High (0)

Neighbor: 87.71.5.18

• Risk Score: 0
• Authority Score: 50

---

## RELATIONSHIP GRAPH

Seventeen relationships identified, all classified as "Same Network" with target value "DHCP-99-OD." No organizational, certificate, or hostname relationships detected beyond network-level associations.

---

## ASSESSMENT & RECOMMENDATIONS

Threat Profile: This IP represents a high-risk single-service host with persistent SSH exposure. The combination of DNSBL listings (6/8), route instability, and high risk score warrants monitoring. The neighborhood appears relatively clean with one active sibling.

Recommended Actions:

1. Block inbound SSH traffic from this IP at perimeter firewall

2. Monitor for lateral movement attempts within the /24 subnet

3. Verify DNSBL listings via RDAP abuse contact

4. Add to threat intelligence watchlist for repeat observation

Priority: MEDIUM-HIGH

Action Required: Firewall rule deployment recommended for inbound SSH traffic blocking.

---

*Generated by IPDebrief Intelligence Platform*

*All data sourced from live network observation and threat intelligence feeds*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.