137.255.13.247📋 Copy

# IP Intelligence Briefing: 137.255.13.247/32

Classification: Moderate Risk | Date: 2026-07-29 | Status: Active

## Executive Summary

IP address 137.255.13.247 is registered to organization Vivien ASSANGBE under ASN 328228 and operates from the 137.255.12.0/22 block. The asset presents a moderate risk profile (score: 50) with a single-service SSH host configuration. The IP is listed on 8 DNSBLs with 2 high-severity listings and shows evidence of geographic signal inconsistency.

## Technical Profile

## Key Observations

Network Context

The IP belongs to a /24 subnet (137.255.13.0/24) with mixed classification and moderate abuse density (0.3333). Of 9 sibling IPs, 6 remain active with 3 flagged as threat-related. Risk distribution within the subnet shows 3 medium-risk and 5 low-risk neighbors, with no high-risk siblings identified.

Reputation Signals

• DNSBL Presence: Listed on 8 blacklists including high-severity entries
• Ownership Stability: No ownership changes recorded
• Service Classification: Single-service host (SSH)
• Campaign Correlation: No known campaign matches or certificate associations

Geographic Anomalies

Signal history reveals conflicting geolocation data: current profile indicates GB (London), while historical observations reference BJ (Benin). This inconsistency warrants monitoring for potential spoofing or multi-region operations.

Control Plane

• Route Stability: Flagged as unstable (isRouteStable: false)
• BGP Prefix: 137.255.13.0/24
• RPKI State: Not validated
• IRR Consistency: Not verified

## Recommended Actions

Based on the risk profile, the following defensive measures are recommended:

## Intelligence Notes

• SSH Service: The single open port (22) indicates a dedicated SSH host, typical of hosting infrastructure or compromised systems.
• DNS Association: The reverse DNS record (sbin.bj) suggests potential geographic spoofing given the .bj TLD (Benin) versus GB geolocation.
• Historical Volatility: 17 observations recorded with multiple signal type changes, indicating active monitoring of this address.
• Threat Persistence: Current threat observation count is 1 with 0 threat persistence days; not classified as persistently malicious.

## Conclusion

IP 137.255.13.247 warrants defensive blocking due to DNSBL listings, geographic signal inconsistency, and unstable route characteristics. The moderate risk score (50) combined with the single-service SSH configuration and subnet-level threat activity suggests this asset should be treated as potentially suspicious. Continue monitoring for changes in geolocation, DNS records, or service exposure.

---

*Data sourced from IPDebrief Intelligence Platform. All findings based on observed signal data as of 2026-07-29.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.