139.180.163.29📋 Copy

# IP Intelligence Briefing: 139.180.163.29/32

Classification: Moderate Risk Cloud Infrastructure Asset

Date: [Current Date]

Risk Score: 65/100

---

## Executive Summary

IP address 139.180.163.29 is a Vultr cloud computing VPS hosted in Sydney, Australia, operating as a web server with moderate risk profile (65/100). The system is associated with the domain icare-catalogue.com and vps1708.tmdvps.com. While the /24 subnet demonstrates clean abuse characteristics, the IP is listed on three DNS blacklist entries with high severity ratings, warranting monitoring for potential spam or abuse activity.

---

## Infrastructure Profile

Ownership & Provider:

• ASN: 20473 (IRT-CHOOPALLC-AP)
• Provider: Vultr (Cloud Compute)
• Network Type: Cloud Infrastructure / Hosting
• CIDR Block: 139.180.160.0/20
• Routing Status: BGP stable, route changes: 0 in last 30 days
• RPKI: State not validated

Geolocation:

• Country: Australia (AU)
• City/Region: Sydney, NSW
• Accuracy: ±2000km (RDAP registration source)
• Geographic Plausibility: Flagged as implausible by validation checks

DNS Infrastructure:

• PTR Hostname: vps1708.tmdvps.com
• Primary Domain: icare-catalogue.com
• SPF Record: v=spf1 +a +mx +ip4:139.180.163.29 ~all (configured)
• DMARC Record: Not present
• DNSBL Listings: 3 of 8 total lists (high severity)

---

## Service Exposure

Open Ports:

TLS/SSL Certificate:

• Issuer: Let's Encrypt (R12)
• Subject: *.icare-catalogue.com
• SANs: *.icare-catalogue.com, icare-catalogue.com
• Status: Valid, non-self-signed
• HSTS: Not enabled
• CSP: Not configured

HTTP Fingerprint:

• Server: Apache
• HTTP/2: Enabled
• Status Code: 500 (error state observed)

---

## Threat Indicators

Observed Threat Activity:

• Abuse Confidence Score: Not provided
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None identified

Blacklist Status:

• DNSBL Listed: 3 entries
• Total DNSBL: 8 lists
• Maximum Severity: High

Campaign Correlation:

• Likelihood: None
• Cert Matches: 0
• Correlated IPs: 0

---

## Historical Observations

Signal History: 27 observations recorded

• Recent DNS Activity: SPF record pointing to 139.180.163.29 for icare-catalogue.com (2026-06-26)
• Provider Identification: Vultr cloud infrastructure consistently identified
• Geolocation: Australia (AU) with variable confidence scores
• Threat Persistence: No persistent malicious behavior detected
• Ownership Stability: No ownership changes recorded

---

## Network Neighborhood Analysis

Subnet: 139.180.163.0/24

• Abuse Density: 0 (mostly clean)
• Risk Classification: Mostly clean
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2/100

Relationship Graph:

• DNS Associations: Multiple associations to vps1708.tmdvps.com
• Network Peers: AUS_VULTR_CUST network
• Total Relationships: 81 entities (primarily DNS and network associations)

---

## Recommended Actions

Immediate Actions:

1. Monitor DNSBL Listings: Investigate the 3 DNSBL entries with high severity ratings

2. Verify Legitimate Use: Confirm icare-catalogue.com is a legitimate service

3. SSH Access Review: Evaluate necessity of port 22 access from external networks

4. DMARC Implementation: Deploy DMARC record for icare-catalogue.com to enhance email authentication

Firewall/Filtering Rules:

• Block if the 3 DNSBL listings are confirmed malicious
• Monitor traffic patterns for anomalies
• Allow if legitimate business use is verified

Long-term Mitigation:

• Implement DMARC policy for associated domains
• Consider disabling SSH from external networks if not required
• Monitor for any changes in DNSBL status

---

## Risk Assessment

Overall Risk: MODERATE

Key Risk Factors:

• Listed on multiple DNSBLs with high severity
• Error state (HTTP 500) observed on HTTPS endpoint
• No DMARC record configured
• Geographic validation flagged as implausible

Mitigating Factors:

• Clean subnet abuse density
• No known malicious campaigns or attacker attribution
• Standard cloud infrastructure configuration
• Let's Encrypt TLS certificate indicates active maintenance

Recommendation: Monitor closely for DNSBL status changes and verify legitimate business use of the icare-catalogue.com domain. Consider temporary filtering if DNSBL listings confirm malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.