13.49.141.132📋 Copy

# IP Intelligence Briefing: 13.49.141.132

## Executive Summary

IP address 13.49.141.132 is a cloud compute instance belonging to Amazon Web Services (AWS) operating within the eu-north-1 region (Stockholm, Sweden). The IP carries a Moderate Risk rating (score: 50) and is associated with legitimate cloud infrastructure while showing some blacklist presence. No active threat campaigns or malicious activity indicators were detected.

## Ownership & Infrastructure Profile

• Organization: Amazon Data Services Sweden
• ASN: 16509 (AMAZON-02)
• CIDR Block: 13.48.0.0/14
• Geolocation: Stockholm, Sweden (59.33°N, 18.07°E)
• Infrastructure Type: CloudCompute (EC2 instance)
• Hostname: ec2-13-49-141-132.eu-north-1.compute.amazonaws.com

## Technical Observations

• Active Services: SSH (22/tcp) with OpenSSH 8.0 banner
• DNS Resolution: Forward confirmed to Amazon compute hostname
• Email Authentication: SPF and DMARC records present
• Control Plane: Route stability flagged as unstable; 2 DNSBL listings across 8 total lists

## Risk Assessment

• Overall Risk Score: 50 (Moderate)
• Operator Score: 0.2609 (Basic classification)
• Abuse Density: 1 (low)
• DNSBL Status: Listed on 2 threat feeds

## Temporal Analysis

Signal observation history (25 observations) indicates intermittent blacklist activity. Notable observations include:

• June 17-18, 2026: Multiple blacklist listings with high severity ratings
• ASN geolocation resolution showed US origin in some feed lookups despite Swedish hosting
• No evidence of persistent malicious activity or campaign correlation

## Neighborhood Context

Subnet 13.49.141.132/24 exhibits low abuse density with no immediate sibling IPs flagged as high-risk. The broader network classification is "mostly clean" with inherited risk score of 2.

## Recommended Actions

1. Allow Traffic: This IP operates legitimate AWS infrastructure with proper email authentication and low abuse indicators

2. Monitor SSH Access: Standard SSH service on port 22; ensure inbound SSH is restricted to authorized management ranges if applicable

3. DNSBL Review: Investigate the 2 DNSBL listings if they impact legitimate traffic flows; verify listing reasons

4. No Block Required: Risk profile does not warrant blocking; treat as trusted cloud infrastructure

## Intelligence Confidence

High confidence in AWS ownership and infrastructure classification. Moderate confidence on blacklist activity due to intermittent nature of observations. No actionable threat indicators requiring immediate defensive response.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.