154.70.167.241
IP Intelligence Briefing: 154.70.167.241
Date: 2026-05-30
---
**Key Risk Indicators**
- Risk Score: 70 (High Risk)
- Threat Observations: 19 total signals (last 30 days)
- Network Subnet: 154.70.160.0/21 (mostly clean, abuse density: 1)
- Geolocation: Saint Christopher and Nevis, Victoria (SC)
---
**Ownership & Infrastructure**
- ASN: 36902 (Frederick Abrams)
- Network Role: Multi-service host (HTTP/SSH)
- Services:
- SSH: Running Dropbear (SSH-2.0-dropbear_2012.55)
- HTTP: HTTP/1.1 server (TP-LINK fingerprint)
- DNS:
- PTR hostname: `host-154-70-167-241.intelvision.net`
- DNSSEC validated, no CAA records
---
**Threat & Vulnerability Context**
- No Malicious Indicators: No indicators of compromise (IOCs), spam, or known attacker activity.
- Network Scans: Detected open ports (80/HTTP, 22/SSH) with no active threats.
- Subnet Risk: 1 threat sibling in /24 subnet; 0 active malicious IPs.
---
**Observation History**
- Recent Activity:
- HTTP fingerprint (2026-05-29): Server banner "TP-LINK," HTTP/1.1, TTFB 706ms.
- SSH scan (2026-05-29): Dropbear SSH service detected.
- Geolocation (2026-05-30): Victoria, SC (latitude -4.62, longitude 55.45).
- Trend: Stable risk profile; no escalating threats detected.
---
**Relationships & Network Context**
- Shared Subnet: 154.70.160.0/21 (Frederick Abrams).
- DNS Associations:
- `host-154-70-167-241.intelvision.net` (mixed DNS resolution success/failure).
- Control Plane:
- BGP prefix: 154.70.164.0/22 (RPKI state: unknown).
- Low operator risk score (0.13).
---
**Recommendations**
1. Monitor SSH Service: Investigate Dropbear SSH configuration for potential vulnerabilities.
2. Geolocation Validation: Verify if the SC IP aligns with expected traffic patterns.
3. DNS Health Check: Investigate DNS resolution failures for `192.168.2.108` (internal IP?); ensure DNSSEC is properly configured.
4. Subnet Review: Watch for anomalies in 154.70.160.0/21 due to low abuse density but 1 threat sibling.
---
End of Briefing
*Generated by IPDebrief intelligence tools.*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Frederick Abrams |
| ASN | AS36902 |
| Network Name | 154.70.160.0 - 154.70.167.255 |
| CIDR Block | 154.70.160.0/21 |
| RIR | AFRINIC |
| Country | SC |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | host-154-70-167-241.intelvision.net |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | host-154-70-167-241.intelvision.net |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Multi-Service Host |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 443, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | TP-LINK |
| HTTP Title | — |
| SSH Version | SSH-2.0-dropbear_2012.55 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 27% | 2 | 4 |
| ownership | 19% | 2 | 2 |
| reputation | 22% | 1 | 3 |
| geolocation | 13% | 1 | 1 |
| Overall | 21% | 9 | 15 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-14 01:08:40 UTC |
| Last Seen | 2026-06-07 01:23:01 UTC |
| Profile Built | 2026-06-07 01:31:11 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 21 |
Full dossier details are available via our API.