149.102.144.215📋 Copy

# IP Intelligence Briefing: 149.102.144.215/32

Date: Current

Classification: Low Risk

Analyst: IPDebrief Intelligence Team

## Executive Summary

IP 149.102.144.215 presents as a low-risk web server infrastructure endpoint with minimal threat indicators. The IP operates as a Contabo-hosted web server within the Cogent Communications network infrastructure. While the endpoint itself shows low risk, the /24 subnet contains one threat-identified sibling IP, warranting monitoring of related addresses.

## Ownership and Infrastructure

• ASN: 51167
• Organization: Cogent Communications, LLC
• Network Provider: Contabo
• BGP Prefix: 149.102.144.0/21
• RIR: ARIN
• Geolocation: US (Portsmouth)

## Network Services

The endpoint exposes three open ports:

• Port 80/tcp: HTTP web server
• Port 443/tcp: HTTPS web server
• Port 22/tcp: SSH (OpenSSH_9.6p1 Ubuntu-3ubuntu13.16)

Web Server Stack:

• Server: Tengine
• TLS Certificate: Let's Encrypt (R12 issuer)
• Certificate Subject: hotspot.lipanet.co.ke
• HTTP/2 enabled
• HSTS header present

## DNS Analysis

• PTR Hostname: lipanet.co.ke
• Forward Resolution: lipanet.co.ke (co.ke domain)
• Email Security: SPF and DMARC records absent
• TXT Records: None detected

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None

Control Plane Indicators:

• DNSBL Listed: 1 of 8 lists checked
• Operator Score: 0.2609 (Basic)
• Route Stability: False

## Neighborhood Analysis

• Subnet: 149.102.144.0/24
• Abuse Density: 1
• Classification: Mostly clean
• Active Siblings: 1
• Threat Siblings: 1
• Inherited Risk: 2

One adjacent IP in the /24 subnet has been flagged for threat activity.

## Relationship Graph

The IP maintains 45 recorded relationships, primarily:

• DNS associations with lipanet.co.ke
• Network associations with COGENT-149-102-16

## Observation History

• Total Observations: 23
• Threat Persistence Days: 0
• Is Persistently Malicious: No
• Recent Signals: HTTP/2 headers, HSTS present, DNSSEC validation checks
• Last Observed: June 2026

## Security Recommendations

Immediate Actions:

1. Monitor Sibling IPs: The /24 subnet contains one threat-identified sibling IP. Add 149.102.144.0/24 to monitoring watchlist.

2. DNS Security Gap: Verify SPF and DMARC records for co.ke domain.

3. SSH Exposure: Port 22 is open. Confirm this is intentional and consider restricting access.

Firewall Rules (Recommended):

```bash

# Block if SSH should not be accessible

iptables -A INPUT -p tcp --dport 22 -j DROP

# Allow HTTP/HTTPS with rate limiting

iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/min -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/min -j ACCEPT

```

Monitoring Priority: LOW

The endpoint itself does not require immediate blocking. Focus monitoring efforts on the sibling threat IP within the same subnet.

---

Data Sources: IPDebrief Intelligence Platform

Confidence Level: Moderate

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.