154.219.112.227📋 Copy

# IP Intelligence Briefing: 154.219.112.227/32

## Executive Summary

IP 154.219.112.227 presents a LOW RISK threat profile with an overall risk score of 25. The address is registered to Cloud Innovation Support (ASN 401701) within the 154.219.112.0/24 block. No active malicious campaigns or blacklist associations have been identified. The IP maintains minimal neighborhood abuse density and shows stable, single-service host characteristics.

## Ownership and Infrastructure

• Organization: Cloud Innovation Support
• ASN: 401701
• CIDR Block: 154.219.112.0 - 154.219.112.255 (/24)
• RIR: afrinic
• Network Classification: Single-Service Host
• DNSBL Listings: 1 of 8 threat feeds (minimal operator score: 0.1304)

## Network Services and Fingerprinting

• Open Ports: TCP/22 (SSH)
• SSH Banner: SSH-2.0-OpenSSH_9.2p1 Debian-2
• Infrastructure Flags: Not cloud, CDN, VPN, proxy, Tor, or hosting infrastructure
• Control Plane: Route-stable (0 changes in 30 days), DNSSEC valid

## Geolocation Intelligence

Geolocation data shows significant inconsistency across multiple observation points:

• Primary consensus: United States (US)
• Historical observations: Seychelles (22.2578°S, 114.1657°E) and Hong Kong (HK)
• Measured distance: 9,175 km from observation point
• Average RTT: 294.6ms (minimum possible: 183.5ms)
• Traceroute: 15 hops via Comcast and NTT transit networks

This geographic variance warrants monitoring but does not indicate confirmed spoofing at this risk level.

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Blacklist Count: 0
• Threat Persistence: 0 days
• Campaign Correlation: None

## Neighborhood Analysis

The /24 subnet (154.219.112.0/24) demonstrates a CLEAN classification:

• Abuse Density: 0
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution: No high or medium-risk neighbors identified

## Observation History Summary

16 observations recorded. Recent activity (July 30, 2026) shows:

• ASN and RIR registration data from afrinic
• Multiple geolocation signals with inconsistent country assignments
• Traceroute validation with 15 hops
• RTT measurements consistent with transcontinental distance
• No new threat indicators emerged

## Relationship Graph

Single relationship identified: Same Network (154.219.112.0 - 154.219.112.255). No additional links to organizations, hostnames, or certificates.

## Recommended Actions

Based on current risk assessment (score 25), no immediate firewall rules or blocking actions are recommended. The IP does not meet thresholds for automatic remediation. Monitor for:

• New blacklist associations
• Geolocation pattern changes
• Emergence of malicious indicators

## SOC Analyst Notes

This IP appears to be a legitimate, low-risk endpoint with standard SSH service exposure. The geolocation inconsistencies are noted but fall within acceptable variance for distributed infrastructure. No immediate threat mitigation required. Continue passive monitoring for threat indicator emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.