104.164.173.98
# IP Intelligence Briefing: 104.164.173.98/32
Date: 2026-07-23
Classification: Low Risk / Monitoring Recommended
---
## Executive Summary
IP 104.164.173.98 is assigned to EGIHosting (ASN 18779), a colocation hosting provider. The IP maintains a low-risk profile with a risk score of 25. No active threat indicators are present, and the IP shows no evidence of malicious activity. However, geolocation data validation reveals significant anomalies requiring attention.
---
## Ownership and Infrastructure
| Attribute | Value |
|---|---|
| **Organization** | EGIHosting (EGNL-1) |
| **ASN** | 18779 |
| **CIDR Block** | 104.164.0.0/15 |
| **Geolocation** | Santa Clara, CA, US |
| **Infrastructure Type** | Colocation Hosting |
| **Network Role** | Firewalled / No Services |
The IP is classified as hosting infrastructure with no open ports or active services detected. DNS analysis returned no PTR records or forward resolution. Email authentication records (SPF, DMARC) are absent.
---
## Threat Indicators
| Indicator | Status |
|---|---|
| **Risk Score** | 25 (Low) |
| **Abuse Confidence Score** | Not Available |
| **Known Attacker** | No |
| **Tor Exit Node** | No |
| **Spam Source** | No |
| **Blacklist Count** | 0 |
| **Threat Feeds** | None |
Threat Persistence: No persistent malicious behavior detected. The IP shows zero threat persistence days and no campaign correlations.
---
## Neighborhood Analysis (104.164.173.0/24)
| Metric | Value |
|---|---|
| **Subnet Classification** | Clean |
| **Abuse Density** | 0 |
| **Total Siblings** | 10 |
| **Active Siblings** | 2 |
| **Threat Siblings** | 0 |
The /24 subnet demonstrates minimal abuse activity. Risk distribution shows 9 low-risk neighbors and no medium or high-risk neighbors. Several sibling IPs (104.164.173.22, 104.164.173.29, 104.164.173.60, 104.164.173.145, 104.164.173.147, 104.164.173.151, 104.164.173.197) carry similar risk scores of 25.
---
## Historical Signal Analysis
18 observations tracked to date. Key temporal findings:
- Abuse Density: Recent observations show 0.3636 abuse density with "mixed" classification and 10 inherited risk
- Blacklist Activity: Historical observation (2026-07-23 07:37:38 UTC) indicates 8 total blacklist listings with 1 listed at "high" severity
- Geolocation Consistency: Persistent RTT validation violations observed
Critical Anomaly: Traceroute and geo-validation data show a distance of 8,857.7 km (claimed lat: 37.3931, claimed lon: -121.962) with observed RTT of 87-90ms. This violates physics—minimum possible RTT for this distance should be 177.15ms+. This indicates either:
- Geographic spoofing or misconfiguration
- Proxy/gateway routing not reflected in geolocation
- Data collection error
Geo Plausible: False (violation detected)
---
## Control Plane Status
| Parameter | Status |
|---|---|
| **BGP Prefix** | 104.164.173.0/24 |
| **Route Stability** | Not Stable |
| **Route Changes (30d)** | 0 |
| **RPKI State** | Not Available |
| **DNSSEC Valid** | True |
| **Operator Score** | 0.1304 (Minimal) |
---
## Recommended Actions
No specific firewall rules or blocking recommendations generated. The IP maintains low-risk status with no actionable threat indicators.
SOC Analyst Guidance:
1. Monitor: Track for service activation (port scanning, DNS queries)
2. Context: Review against known EGIHosting infrastructure patterns
3. Alert Threshold: Escalate if threat indicators emerge or abuse density increases
4. Geolocation Review: Investigate RTT/geo validation anomaly if traffic patterns suggest compromise
---
## Conclusion
IP 104.164.173.98 represents low-risk infrastructure from a legitimate hosting provider. No immediate action required. The geolocation validation anomaly warrants passive monitoring but does not constitute a threat indicator at present. Continue standard baseline monitoring procedures.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | EGIHosting |
| ASN | AS18779 |
| Network Name | EGNL-1 |
| CIDR Block | 104.164.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS18779 |
| Network Prefix | 104.164.173.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 17% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 17% | 2 | 3 |
| reputation | 14% | 1 | 3 |
| geolocation | 17% | 2 | 3 |
| Overall | 14% | 10 | 16 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-04 00:11:44 UTC |
| Last Seen | 2026-08-26 12:21:19 UTC |
| Profile Built | 2026-08-29 08:15:38 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 21 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 104.164.173.98
Who owns the IP address 104.164.173.98?
104.164.173.98 is registered to EGIHosting. The address falls within the 104.164.0.0/15 network block. Registration is held at ARIN.
Where is 104.164.173.98 located?
Geolocation data places 104.164.173.98 in Santa Clara, California, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 104.164.173.98 malicious or safe?
104.164.173.98 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
Is 104.164.173.98 a VPN, proxy, or data center address?
104.164.173.98 is classified as hosting infrastructure based on network ownership and behavioural analysis.