107.173.67.180📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 107.173.67.180/32

Classification: Moderate Risk (Risk Score: 50)

Report Date: 2026-07-29

Data Source: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 107.173.67.180 is a moderate-risk IP address (risk score 50) associated with VortexServers hosting infrastructure. The address resolves to a PTR hostname associated with a European domain and exhibits DNSBL listings. No active threat indicators or malware campaigns detected. Recommended action: Block at perimeter firewall.

---

## NETWORK OWNERSHIP & ATTRIBUTION

The IP is hosted under VortexServers infrastructure within a /25 subnet. Ownership has remained consistent across observations with no changes recorded.

---

## THREAT INTELLIGENCE

• Risk Score: 50 (Moderate)
• Provider Score: 0
• Authority Score: 0
• Operator Score: 0.1304 (Minimal)
• Threat Indicators: None detected
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Listings: 2 out of 8 total lists

No active threat feed correlations or known malicious activity observed. The IP is not classified as a Tor exit node, known attacker, or spam source.

---

## NETWORK BEHAVIOR & INFRASTRUCTURE

• Infrastructure Type: Hosting (firewalled/no services detected)
• Open Ports: None detected
• TLS Certificate: None detected
• Connection Type: Standard TCP/IPv4
• Cloud Provider: No
• CDN: No
• Proxy/VPN: No
• Mobile Carrier: No

The address shows no active services or open ports, indicating a passive or firewalled configuration.

---

## DNS & EMAIL REPUTATION

DNS analysis reveals associations with a European domain (eu.com). Email authentication is partially implemented with SPF but lacks DMARC policy.

---

## OBSERVATION HISTORY

Total Observations: 14

Observation Period: Recent (2026-07-29)

Recent signals indicate:

• Consistent ownership attribution to VortexServers
• Geographic consensus showing Buffalo, NY (with one outlier probe showing Kansas coordinates at 35% confidence)
• Traceroute: 16 hops with Comcast as primary transit network
• No significant threat persistence patterns

---

## NETWORK RELATIONSHIPS

---

## SUBNET ANALYSIS (107.173.67.0/24)

• Abuse Density: 0
• Total Siblings: 3
• Risk Distribution: 0 High, 1 Medium, 2 Low

The subnet exhibits low-to-moderate risk distribution with no high-risk neighbors.

---

## RECOMMENDED SECURITY ACTIONS

Firewall Blocking Rules

```bash

# iptables

iptables -A INPUT -s 107.173.67.180 -j DROP

# nftables

nft add rule inet filter input ip saddr 107.173.67.180 drop

# nginx

deny 107.173.67.180;

# pfSense

107.173.67.180/32

# Cloudflare WAF

{"description":"Block 107.173.67.180 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 107.173.67.180"}}

# AWS WAF

{"Addresses":["107.173.67.180/32"],"Description":"IPDebrief risk 50"}

```

Risk Assessment

• Block Recommended: Yes (Risk Score 50, DNSBL listings)
• Monitor Only: Not recommended given DNSBL presence
• Allow with Scrubbing: Not recommended without further investigation

---

## ANALYST NOTES

The IP address exhibits moderate risk primarily due to DNSBL listings and association with a European domain through PTR records. The lack of open ports and active services suggests the infrastructure is either properly secured or actively firewalled. No direct malicious indicators detected in current observations.

Priority: Medium

Action Required: Block at perimeter defense points

Review Period: 30 days

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.