16.171.70.138

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

Narrative

The IP address 16.171.70.138 has been identified as an active attacker that triggered a honeypot, indicating malicious activity related to credential stuffing. The IP is associated with Amazon Data Services Sweden, located in Stockholm, Sweden, and has a risk score of 60 based on direct attack evidence.

Classification Tags

DatacenterSwedenModerate RiskModerate ConfidenceCredential StufferFirewalled / No Services

Signal Summary Table

Category	Finding	Confidence
Geolocation	Stockholm, Sweden	Very Low
Ownership	Amazon Data Services Sweden (ARIN)	Moderate
Infrastructure	Datacenter	Moderate
Threat Lists	Honeypot, Credential Stuffer	High
Open Ports	None	Very Low
Risk Score	60	High
TLS	None	Very Low
PTR	None	Very Low
FCrDNS	None	Very Low
BGP	Insufficient routing data to classify	Very Low

Notable Findings

🚨 Critical: The IP triggered a honeypot, indicating malicious activity.
⚠️ Warning: The infrastructure type is classified as "Unknown" but inferred to be a datacenter.
ℹ️ Info: The IP has no PTR record and no FCrDNS.
ℹ️ Info: The IP has no open ports detected.
❓ Unknown: There is insufficient routing data to fully classify the network role.

Recommended Actions

Block immediately — confirmed honeypot trap triggered, indicative of credential stuffing attacks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇸🇪 Sweden
Region	AB
City	Stockholm
Timezone	Europe/Stockholm
Latitude	59.33
Longitude	18.07

🛡️ Platform Security History

Honeypot

Trap endpoint probes

Total events: 1

Observed on 2026-05-16

🏢 Ownership & Registration

Organization	Amazon Data Services Sweden
ASN	AS16509
Network Name	—
CIDR Block	16.170.0.0/15
RIR	ARIN
Country	—
Abuse Contact	Available via RDAP

🌐 DNS Intelligence

PTR	ec2-16-171-70-138.eu-north-1.compute.amazonaws.com
Forward Confirmed	Yes — FCrDNS verified
Hosted Domain	ec2-16-171-70-138.eu-north-1.compute.amazonaws.com
Forward Hostnames	`ec2-16-171-70-138.eu-north-1.compute.amazonaws.com`

🔐 DNS Hygiene

Hygiene Score	80% (Excellent)
SPF	Present
DMARC	Present
FCrDNS	Verified
DNSSEC	Valid
CAA	Not configured

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Firewalled / No Services
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
No open ports detected
Closed Ports	22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned)

Server	—
HTTP Title	—

🔐 TLS Certificate

🔒

No certificate

Issued by —

N/A

SANs	None
Valid From	—
Valid Until	—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	29%	2	4
routing	19%	3	4
services	15%	2	2
ownership	22%	3	4
reputation	24%	1	3
geolocation	39%	2	3
Overall	24%	13	20

Coverage: 6/6 dimensions · Data sufficiency: sufficient

Data Coherence	Consistent (100%)
Attribution	Moderate (70%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

📅 Observation Timeline 🔄 Live

First Seen	2026-05-16 23:43:31 UTC
Last Seen	2026-06-28 04:07:32 UTC
Profile Built	2026-06-28 22:13:26 UTC
Data Freshness	Live
Signal Types	33
Total Observations	36

🔍 33 signal types · 36 observations collected

This report is generated from 33+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

16.171.70.138📋 Copy