144.202.92.17📋 Copy

# IP Intelligence Briefing: 144.202.92.17

Classification: High Risk

Analysis Date: 2026-07-30

Assigned To: SOC Intelligence Team

## Executive Summary

IP 144.202.92.17 presents a high-risk profile (Risk Score: 80) despite operating on a subnet with zero abuse density. The address is owned by Vultr Holdings, LLC and appears to be a cloud compute resource with no publicly accessible services. The IP is listed on 4 of 8 DNS blacklists, indicating prior reputation issues.

## Technical Profile

Ownership & Infrastructure

• Provider: Vultr Holdings, LLC (ASN: 20473)
• Network Block: 144.202.92.0/23
• Infrastructure Type: Cloud Compute
• Service Status: Firewalled / No Services detected

Geolocation

• Country: United States (US)
• Region: Washington, Kent
• Validation Status: ICMP blocked - unable to validate
• Claimed Coordinates: 47.3798°N, -122.2893°W

DNS Configuration

• PTR Hostname: 144.202.92.17.vultrusercontent.com
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF and DMARC records present

Threat Indicators

• DNSBL Listed: 4 of 8 total blacklists
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

## Risk Assessment

Anomaly Detected: Significant discrepancy between individual IP risk score (80) and subnet abuse density (0). This suggests the risk classification may be legacy or based on historical rather than current activity.

## Network Context

Subnet Analysis (144.202.92.0/24)

• Active Siblings: 0
• Threat Siblings: 0
• Abuse Classification: Clean
• Risk Inheritance: 0

Relationship Graph

• Same Network: NET-144-202-92-0-23 (3 relationships)
• DNS Associations: 144.202.92.17.vultrusercontent.com (4 relationships)

## Observation History

Recent Activity (Last 18 Observations)

• Port Scanning: Detected on 2026-07-30 21:00:47 UTC
• Connectivity: ICMP blocked - unable to validate
• Geolocation: Multiple data sources with conflicting coordinates
• Ownership: Stable (0 ownership changes observed)
• Persistence: Not persistently malicious

## Recommended Actions

Immediate (Priority: Medium)

• Review DNS blacklist entries to determine if removal is warranted
• Monitor for new service openings on previously firewalled IP
• Add to blocklist if blacklist persistence confirms malicious use

Ongoing Monitoring

• Track for service activation (currently no open ports)
• Monitor subnet 144.202.92.0/24 for related activity
• Watch for changes in DNS blacklist status

Firewall Rules

• Allow traffic only if business requires connection to Vultr cloud infrastructure
• Consider blocking if no legitimate use case exists
• Monitor for port scanning activity

## Conclusion

IP 144.202.92.17 presents elevated risk indicators despite operating in a clean subnet environment. The combination of multiple DNS blacklist entries and high risk score suggests prior malicious activity. The current state shows no active services, but the IP should be monitored for service activation or reputation changes. The discrepancy between individual risk score and subnet cleanliness warrants periodic reassessment.

Status: Monitor / Conditional Block

Risk Level: High

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.