154.217.246.151📋 Copy

# IP Intelligence Briefing: 154.217.246.151/32

## Executive Summary

IP 154.217.246.151 is a low-risk web server endpoint operating under Cloud Innovation Support (ASN 400619). The asset demonstrates standard web infrastructure characteristics with no active threat indicators. Current risk assessment: 30/100 (Low Risk).

---

## Network Profile

---

## Technical Characteristics

Open Ports:

• 80/tcp (HTTP)
• 443/tcp (HTTPS)
• 22/tcp (SSH) - OpenSSH_9.6p1 Ubuntu-3ubuntu13.18
• 8080/tcp (HTTP-alt)

Server Stack:

• Web Server: nginx/1.24.0 (Ubuntu)
• TLS: TLS_AES_256_GCM_SHA384 (TLS 1.3)
• Certificate: Let's Encrypt (CN=aaaapi.lol)

---

## Threat Assessment

Positive Indicators:

• No known threat indicators
• Zero blacklist entries
• Not classified as Tor exit, proxy, or hosting service
• Route stable: false (monitor recommended)

Notable Findings:

• DNSBL listed on 8 lists with 0 abuse confidence score
• Geo validation flagged implausible location (7,832km distance, RTT 115ms < theoretical minimum 156.6ms)
• DNSSEC valid: true

---

## Neighborhood Analysis (154.217.246.0/24)

The /24 subnet shows no abuse activity or correlated threat behavior.

---

## Historical Observations (17 signals)

Recent fingerprinting confirms consistent web server behavior:

• Content Security Policy enabled with strict nonce configuration
• HSTS not enforced
• HTTP/2 protocol active
• Content-Type: nosniff headers present
• X-Frame-Options: DENY configured

---

## Operational Intelligence

Control Plane:

• BGP Prefix: 154.217.240.0/21
• Route stability: false (requires monitoring)
• DNSSEC: Valid
• RIR Registry: afriNIC

Temporal:

• Ownership changes: 0
• Threat persistence days: 0
• Persistently malicious: false

---

## Recommended Actions

Firewall Rules: No blocking recommendations. Standard allow rules for web traffic (80/443) with SSH access control apply.

---

## Conclusion

The IP 154.217.246.151 presents as a legitimate web infrastructure endpoint with no active threat indicators. Primary concerns are technical (route stability, geo validation discrepancies) rather than malicious. SOC analysts should maintain standard monitoring protocols and verify the DNSBL listing context through secondary sources.

Classification: LOW RISK - WEB SERVER INFRASTRUCTURE

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.