140.248.75.43📋 Copy

IPDEBRIEF INTELLIGENCE BRIEFING: 140.248.75.43/32

Classification: Low Risk – CDN Infrastructure

Date: 2026-07-29

Ownership & Network Identity

The IP address 140.248.75.43 is assigned to Fastly, Inc. (ASN 54113, SKYCA-3) within the 140.248.0.0/16 CIDR block. Geolocation data indicates Frankfurt am Main, Germany, though historical probes showed conflicting US origin data with 35% confidence. The address operates as a CDN node with firewalled service posture—no open ports detected across scanned ranges.

Risk Assessment

Current risk score: 25/100 (Low Risk). The IP carries no active threat indicators, zero blacklist associations, and no known campaign affiliations. Control plane analysis revealed minimal operator score (0.1304) with one DNSBL listing among eight total lists. Route stability is marked false, indicating dynamic routing changes within the 30-day window.

Neighborhood Analysis

The /24 subnet (140.248.75.0/24) contains 15 total sibling addresses. Abuse density measures 0.0667 with a "mostly_clean" classification. Risk distribution shows 14 neighbors at low risk (score 25) and zero high-risk addresses. One threat sibling was identified in historical data. All neighboring IPs maintain identical risk profiles (score 25, authority 50).

Historical Observations

Seventeen signal observations recorded through 2026-07-29. Recent activity includes TLS scanning, port probing, and geolocation validation attempts. No persistent malicious behavior detected. Threat observation count remains at zero with no persistence days recorded.

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Feeds: None
• Known Campaigns: None

Recommended Actions

No immediate firewall or blocking actions recommended. The IP represents legitimate CDN infrastructure. Standard CDN egress traffic patterns expected. No WAF rules required.

Intelligence Summary

The address operates as a standard Fastly CDN node with minimal abuse indicators. The /24 neighborhood demonstrates low abuse density and consistent low-risk profiles across all sibling addresses. No correlation to known malicious campaigns or attacker infrastructure. SOC teams may classify as benign CDN egress with standard monitoring appropriate.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.