DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

Inside 144.172.64.0/24: What 1,004 Neighbouring Hosts Do and Do Not Prove

#attackerinfrastructure #cidr #threatintel #zoomeye

Inside 144.172.64.0/24: What 1,004 Neighbouring Hosts Do and Do Not Prove

IP-based threat intelligence has a habit of expanding from one address to its surrounding network block, and the expansion is usually unjustified. An address that appears in an authentication log is a fact. The 255 other addresses in its /24 are a geography.

This piece examines that distinction using the address reported in the ConnectWise incident, and sets out when neighbourhood context helps an investigation and when it manufactures suspects.

The observed fact

Huntress reported that Microsoft Graph tokens were obtained in customer tenants from 144.172.64[.]128 on 15 October 2026 between 06:13 and 08:34 UTC. The same source noted that the activity originated from an address previously used between 13 and 14 October in password spraying against four law firm tenants, while explicitly declining to tie the two phases to the same operator.

That is the evidential boundary. One address, one time window, one investigator's confidence statement.

What the neighbourhood contains

Queries against ZoomEye on 28 October 2026 returned the following.

Query Count Reading
ip="144.172.64.128" 0 No indexed record for the specific address
cidr="144.172.64.0/24" 1,004 Hosts observed in the surrounding block
cidr="144.172.64.0/24" && country="US" 953 Same block, United States only

The asymmetry is instructive. The single address produced nothing, while the block produced a thousand records. That combination is the normal state of commercial hosting: individual addresses go dark, get reassigned, or never expose a service, while the block as a whole is continuously populated by whatever tenants are renting space.

Why the block count is not a threat indicator

A /24 containing 1,004 observed hosts in a hosting provider's range is unremarkable. Those hosts belong to whoever is paying for them this month: small businesses, mail relays, VPN concentrators, staging environments, and the long tail of internet infrastructure. Nothing in a block-level count distinguishes a compromised relay from a stranger's blog.

When an analyst writes "the actor operates within a hosting range containing more than a thousand hosts," the sentence is technically true and analytically empty. The actor's neighbours are not participants.

Where block context does earn its place

There are three defensible uses.

Corroboration of hosting type. If the block resolves to a commercial hosting provider rather than a residential ISP or a corporate range, that supports a reading of the infrastructure as rented and disposable. It does not identify the renter.

Hunting with proportional scope. A defender reviewing sign-in logs for the incident window might widen the filter from the single reported address to a small set of addresses that appear in the same block and in their own authentication telemetry. The order matters: start from your logs, then check whether the addresses share hosting context. Starting from the block and sweeping it into the logs inverts the evidence.

Change detection. A recorded block-level baseline gives a later comparison something to work against. If an organisation has decided to watch an address range associated with an intrusion, the observation that the count moved from 1,004 to a very different figure is a signal to re-check, not a finding on its own.

The measurement discipline

The zero on the specific address needs to be stated rather than hidden. It means the index held no record matching that address at query time. An address used to authenticate to cloud services may never run a listening service, so an empty result is expected and says nothing about whether the address was involved.

This is the same discipline that applies to any count in this report: absence of an indexed record is not absence of activity, and presence of a neighbour is not presence of a threat.

Limits

All counts reflect a snapshot taken on 28 October 2026. Hosting allocations rotate, and block composition changes quickly. Attribution of the address to any natural person or organisation is not established by public reporting, and no claim in this article should be read as asserting that other addresses in the block were involved in the intrusion.

References

Top comments (0)