109.70.65.65
## IP Intelligence Briefing: 109.70.65.65/32
Classification: Moderate Risk | Risk Score: 55/100 | Last Updated: 2026-07-30
Ownership & Infrastructure
The IP belongs to ASN 9009 (HOSTMETRIC-NL-CLIENTS) under the mnt-us-bahia-1 organization, registered with ARIN. The subnet 109.70.64.0/23 is hosted in Amsterdam, North Holland, Netherlands. The IP is classified as "Firewalled / No Services" with no open ports detected. DNS records are absent, and the IP does not resolve to any hostnames.
Threat Assessment
The IP maintains a moderate risk profile with a risk score of 55. DNSBL listings indicate the IP appears on 3 of 8 total blocklists, with maximum severity rated as high. Despite DNSBL presence, the IP is not identified as a known attacker, Tor exit node, or spam source. No active threat indicators or associated campaigns are detected. The operator score is rated "Minimal" at 0.1304.
Network Behavior & Stability
The IP is not route-stable and exhibits 21 timed-out hops during traceroute analysis, suggesting potential routing issues or geographic distance. Traceroute revealed 30 total hops with Comcast as a transit network. Geo-geolocation validation returned implausible (geoPlausible: false), though the consensus location remains Amsterdam. No honeypot hits, enumeration strikes, or WAF violations were observed.
Observation History
Thirteen observations recorded since 2026-07-30. The most recent signals confirm:
- DNSSEC validation: Valid
- DNSBL listings: 3/8 total (max severity: high)
- Operator score: 0.1304 (Minimal)
- Network classification: Consistent
Neighborhood Analysis
The /24 subnet (109.70.65.0/24) contains one additional neighbor: 109.70.65.92 with a risk score of 40 and authority score of 50. Subnet abuse density is 0. Overall classification remains moderate risk with no high-risk siblings detected.
Recommended Actions
- Monitor: Continue monitoring for changes in DNSBL status and service emergence
- Block Decision: Consider blocking at perimeter if traffic is not expected; DNSBL presence indicates prior reputation issues
- Investigate: Review connection logs for any anomalous traffic patterns from this IP
- Network Context: The /24 subnet contains one medium-risk neighbor (109.70.65.92); monitor both IPs for coordinated activity
Summary: This is a firewalled, residential-like IP with no active services but a history of DNSBL listings. The moderate risk score reflects DNSBL presence rather than active malicious behavior. SOC teams should monitor for service emergence or behavioral changes while evaluating blocking based on business traffic policies.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | mnt-us-bahia-1 |
| ASN | AS9009 |
| Network Name | HOSTMETRIC-NL-CLIENTS |
| CIDR Block | 109.70.64.0/23 |
| RIR | ARIN |
| Country | NL |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 0% | 0 | 0 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 50% | 2 | 3 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 20% | 5 | 6 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-25 14:52:18 UTC |
| Last Seen | 2026-07-30 03:54:01 UTC |
| Profile Built | 2026-07-30 04:04:21 UTC |
| Data Freshness | Live |
| Signal Types | 14 |
| Total Observations | 14 |
Full dossier details are available via our API.