104.49.181.67
Intelligence Briefing: 104.49.181.67
Overview
Analyzed the IP address 104.49.181.67/32. The endpoint was identified as a residential mobile connection associated with AT&T Services, Inc. (AS7018) in Orlando, Florida. Current reputation assessment indicates Low Risk with a risk score of 25.
Technical Classification
The address resolved to a residential endpoint on the AT&T LTE/5G network (MCC: 310, MNC: 410). DNS resolution confirmed the PTR hostname `104-49-181-67.lightspeed.dybhfl.sbcglobal.net`. No open ports or active web services were detected.
Threat Posture
The IP is not classified as a known attacker, spam source, or Tor exit node. Behavioral analysis showed zero total incidents, no WAF violations, and no honeypot strikes. However, the threat actor classification labeled the host as "Suspicious Host" due to presence on one out of eight DNS blacklists. The subnet (104.49.181.67/24) maintained a clean classification with zero threat siblings observed.
Recommendation
Analysis recommends monitoring the endpoint with low severity. The address is located within a clean neighborhood with no inherited risk. SOC teams should observe traffic patterns but no immediate block action is advised.
Observation History
The profile was computed with live data as of 2026-09-06. Control plane data indicated a stable route but noted minor stability fluctuations.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | AT&T Enterprises, LLC |
| ASN | AS7018 |
| Network Name | SIS-80-4-11-2014 |
| CIDR Block | 104.48.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 104-49-181-67.lightspeed.dybhfl.sbcglobal.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 104-49-181-67.lightspeed.dybhfl.sbcglobal.net |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Residential |
| Service Purpose | Residential Endpoint |
| Network Tier | End-User — Residential ISP endpoint |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 27% | 2 | 3 |
| Overall | 22% | 10 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-06 18:06:48 UTC |
| Last Seen | 2026-09-18 18:49:12 UTC |
| Profile Built | 2026-09-18 18:58:58 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 28 |
Full dossier details are available via our API.