104.168.159.150📋 Copy

# Intelligence Briefing: 104.168.159.150

## Executive Summary

IP 104.168.159.150 is a low-risk hosting infrastructure address operated by Hostwinds (ASN 54290). The IP resolves to a web hosting environment serving geturbooking.com with standard web services and no active threat indicators.

## Profile Overview

• Risk Score: 25 (Low Risk)
• Provider: Hostwinds (Infrastructure: Colocation Hosting)
• Reputation: Low Risk
• Classification: Web Server / Hosting
• Country: United States

## Technical Details

• Network Block: 104.168.128.0/17
• PTR Record: hwsrv-1327114.hostwindsdns.com
• DNS Status: Forward confirmed (hostwindsdns.com)
• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• Web Server: nginx/1.24.0 (Ubuntu)
• TLS Certificate: CN=geturbooking.com, O=Let's Encrypt, C=US

## DNS and Security Configuration

• HSTS: Enabled
• CSP: Enabled
• HTTP/2: Enabled
• DNSSEC: Valid
• Email Auth: No SPF or DMARC records configured
• DNSBL Status: Listed on 1 of 8 blacklists (dnsblListedCount: 1)

## Threat Assessment

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Vulnerable/Abuse Indicators: None detected
• Campaign Correlation: No associated campaigns
• Blacklist Count: 0 (active blacklists)

## Historical Analysis

Analysis of 22 observations indicates stable operational patterns:

• Recent Signals (June 2026): DNS associations with geturbooking.com and hostwindsdns.com
• Provider Consistency: Hostwinds identification maintained across observations
• Operator Score: 0.2609 (Basic classification)
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 recorded

## Relationship Graph

The IP maintains associations with:

• DNS Hostname: hwsrv-1327114.hostwindsdns.com (multiple entries)
• Network: HOSTWINDS-17-7

## Subnet Neighborhood Analysis

• Subnet: 104.168.159.150/24
• Abuse Density: 1 (low)
• Classification: mostly_clean
• Active Siblings: 1
• Threat Siblings: 1
• High-Risk Neighbors: 0

## Recommended Actions

Based on risk score of 25 and absence of active threat indicators, no immediate blocking or mitigation actions are recommended. The IP represents a standard commercial hosting environment with expected security controls in place.

## Intelligence Narrative

The target IP 104.168.159.150 operates as a commercial web hosting service within a colocation infrastructure environment. DNS records confirm association with the geturbooking.com domain, serviced through Hostwinds hosting. The IP exhibits standard web server behavior with nginx serving HTTP/HTTPS traffic and SSH access configured. No malicious activity, known attacker patterns, or campaign correlations were identified in the observation history. The subnet demonstrates low abuse density with minimal threat sibling presence. While one DNSBL listing exists, it does not correlate with active threat indicators. The infrastructure maintains stable operational characteristics with no evidence of malicious repurposing.

Risk Level: LOW

Recommended Handling: Monitor as standard infrastructure

Priority: LOW

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.