104.168.132.252📋 Copy

# Intelligence Briefing: 104.168.132.252

## Executive Summary

IP address 104.168.132.252 is classified as a low-risk colocation hosting infrastructure endpoint operated by HostPapa/Hostwinds. The address demonstrates minimal threat indicators, standard web hosting services, and no known malicious activity. Current risk score: 25 (Low Risk).

## Technical Profile

## Open Services

• Port 80/tcp: HTTP (Apache server banner)
• Port 443/tcp: HTTPS (TLS 1.3, TLS_AES_256_GCM_SHA384 cipher)
• Port 22/tcp: SSH (OpenSSH 8.9p1 Ubuntu-3ubuntu0.16)

## Certificate Information

• Issuer: CN=YR1, O=Let's Encrypt, C=US
• Subject: CN=hwsrv-1334678.hostwindsdns.com
• Validation: Valid Let's Encrypt certificate

## Network Classification Flags

• Is Hosting: TRUE
• Is Cloud: FALSE
• Is CDN: FALSE
• Is VPN/Proxy/Tor: FALSE
• Is Tor Exit Node: FALSE
• Is Known Attacker: FALSE
• Is Spam Source: FALSE

## Threat Indicators

• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists
• Known Campaigns: None detected
• Threat Persistence: No persistent malicious activity observed
• Campaign Likelihood: Not applicable

## DNS Configuration

## Observation History

15 observations recorded, most recent from 2026-07-30. Historical signals indicate consistent geolocation (US) and stable infrastructure ownership with no significant changes in threat posture over time.

## Neighborhood Analysis

• Subnet: 104.168.132.0/24
• Abuse Density: 0
• Neighbor Risk: 104.168.132.131 (risk score: null)
• High/Medium Risk Neighbors: 0

## Relationship Graph

• DNS Association: harbourplc.shop
• Network Association: HOSTWINDS-17-7

## Recommended Actions

No specific security actions recommended based on current risk profile. The IP represents standard hosting infrastructure with appropriate security controls (SPF, DMARC, DNSSEC).

## SOC Analyst Notes

This IP belongs to a colocation hosting provider network (Hostwinds/HostPapa). The endpoint serves as a web server with standard services. No immediate threat indicators present. Monitor for any changes in service configuration or threat indicator emergence. Consider the hosting nature when evaluating potential lateral movement risks within the organization.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.