156.38.198.252📋 Copy

# INTELLIGENCE BRIEFING: 156.38.198.252/32

Classification: LOW RISK | Last Updated: 2026-07-23

---

## EXECUTIVE SUMMARY

Target IP 156.38.198.252 presents a low-risk profile with no active threat indicators. The address is associated with Hetzner IP Admin (ASN 37153) and resolves to infrastructure for core.kebc.co.za, a South African domain. Network neighborhood analysis confirms clean classification with zero abuse density.

---

## RISK PROFILE

• Overall Risk Score: 0/10 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Threat Feeds: None detected

---

## OWNERSHIP & GEOLOCATION

• ASN: 37153 (Hetzner IP Admin)
• Network Block: 156.38.198.240/28
• Country: South Africa (ZA)
• Region: Gauteng
• City: Pretoria
• Geolocation Consensus: True (800km accuracy radius)

---

## NETWORK SERVICES

• Open Ports: None detected
• Service Purpose: Firewalled / No Services
• TLS Certificate: None
• HTTP Title: None
• Cloud/CDN/VPN Status: Negative across all categories

---

## DNS ANALYSIS

• Reverse DNS (PTR): core.kebc.co.za
• Forward Resolution: core.kebc.co.za (confirmed)
• SPF Record: Configured
• DMARC Record: Configured
• Hosted Domain Count: 0
• Email Reputation: Not scored

---

## THREAT INDICATORS

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None
• Control Plane Status:

- BGP Prefix: 156.38.128.0/17

- Route Stability: False

- DNSBL Listed: 0/8 lists

---

## NEIGHBORHOOD ANALYSIS

• Subnet: 156.38.198.252/24
• Abuse Density: 0 (Clean)
• Classification: Clean
• Total Siblings: 2
• Active Siblings: 0
• Threat Siblings: 0
• Neighbor IP: 156.38.198.250 (Risk Score: None)

---

## OBSERVATION HISTORY

• Total Observations: 16
• Recent Activity: 2026-07-23
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False

Geolocation Signals:

• South Africa (Gauteng, Pretoria) - Confidence: 70-95%
• No geographic drift observed

---

## RELATIONSHIP GRAPH

• Same Network: 156.38.198.240 - 156.38.198.255
• DNS Association: core.kebc.co.za

---

## RECOMMENDATIONS

1. Firewall: No blocking required; IP presents no threat indicators

2. Monitoring: Standard monitoring sufficient

3. Investigation Priority: Low

4. Action Items: None

---

## ANALYST NOTES

The target IP belongs to a Hetzner-managed block registered in South Africa. The reverse DNS resolution to core.kebc.co.za indicates association with the Kwazulu-Natal e-Library (kebc.co.za). The absence of open ports and services suggests this is a firewalled infrastructure address, likely administrative or internal-facing. The clean neighborhood profile with zero abuse density and no threat siblings supports a benign classification. No defensive action recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.