IPDebrief

100.57.164.115

IP Intelligence Dossier
Your IP: 216.73.217.34
{ } JSON 🔧 Full Actions API
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

Intelligence assessment identified IP 100.57.164.115 as a High Risk asset with a risk score of 70. The endpoint resided within the Amazon Data Services Northern Virginia network (ASN 14618, CIDR 100.48.0.0/12) in Ashburn, VA, operating as a Web Server. Network reconnaissance confirmed the system served HTTPS on port 443 with a GoDaddy certificate for `nvts.co` and returned a 404 HTTP status.

Threat analysis linked the address to 31 correlated IPs and 31 certificate matches, indicating a high likelihood of campaign association. Despite the immediate subnet (100.57.164.115/24) being classified as clean, the system issued a critical severity block recommendation due to the high risk score and strong threat evidence. Security operations recommended blocking the IP using iptables, nginx, or pf firewall rules. Observations occurred between 2026-09-23 and 2026-09-25.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country🇺🇸 United States
RegionVA
CityAshburn
TimezoneAmerica/New_York
Latitude39.04
Longitude-77.49

🏢 Ownership & Registration

OrganizationAmazon Data Services Northern Virginia
ASNAS14618
Network NameAMAZON-IAD
CIDR Block100.48.0.0/12
RIRARIN
CountryUnited States
Abuse ContactAvailable via RDAP

🌐 DNS Intelligence

PTRec2-100-57-164-115.compute-1.amazonaws.com
Forward ConfirmedYes — FCrDNS verified
Forward Hostnamesec2-100-57-164-115.compute-1.amazonaws.com

🔐 DNS Hygiene

Hygiene Score60% (Good)
SPFPresent
DMARCPresent
FCrDNSVerified
DNSSECNot signed
CAANot configured

☁️ Network Classification

InfrastructureUnknown
Service PurposeWeb Server
Network TierUnknown — Insufficient routing data to classify
No specific classification

🔌 Services & Open Ports

PortServiceProtocolBanner
443httpstcp—
Closed Ports22, 25, 80, 3389, 8080, 8443 (1 open / 7 scanned)
Server—
HTTP Title—

🔐 TLS Certificate

An expired certificate for CN=nvts.co was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.
🔒
CN=nvts.co
Issued by CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US
Self-signed: No
SANsnvts.cowww.nvts.co
Valid From2024-03-07T10:49:56+00:00
Valid Until2025-03-26T08:14:23+00:00 (expired)
TLS ProtocolTls13
Cipher SuiteTLS_AES_256_GCM_SHA384
Signature Algorithmsha256RSA
Validity Period383 days
Serial Number3A8D17AD4FE4E785
Thumbprint601F052AD7A6D61ED46C7E5D721C773C6CC6A578

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

DimensionScoreSourcesObservations
threat
40%
23
routing
20%
11
services
40%
23
ownership
40%
23
reputation
20%
12
geolocation
40%
23
Overall33%1015
Coverage: 5/6 dimensions · Data sufficiency: partial
Data CoherenceConsistent (100%)
AttributionModerate (70%)
OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

📅 Observation Timeline 🔄 Live

First Seen2026-09-23 01:25:06 UTC
Last Seen2026-09-25 22:52:27 UTC
Profile Built2026-09-26 01:33:25 UTC
Data FreshnessLive
Signal Types23
Total Observations26
🔍 23 signal types · 26 observations collected
This report is generated from 23+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.
{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.