169.239.183.30📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 169.239.183.30/32

Classification: Low Risk / Investigative Interest

Date: 2026-06-22

---

## EXECUTIVE SUMMARY

IP 169.239.183.30 presents as a low-risk (score: 25) multi-service host located in Somerset West, South Africa. While currently showing no active threat indicators, the IP has been observed on 8 DNSBLs with at least one high-severity listing on 2026-06-22. The subnet (169.239.183.0/24) shows moderate abuse density (16.67%) with 1 threat sibling among 6 total IPs.

---

## OWNERSHIP & NETWORK CLASSIFICATION

• ASN: 329184
• Organization: Michael Osterloh
• CIDR Block: 169.239.183.0 - 169.239.183.255
• RIR: ARIN
• Geolocation: South Africa (Cape, Somerset West) — accuracy radius 800km
• Network Role: Multi-Service Host
• BGP Prefix: 169.239.183.0/24 (route stability: false)

---

## THREAT INDICATORS

• Abuse Confidence Score: Not available
• Blacklist Status: Listed on 1 DNSBL (of 8 total lists checked)
• Threat Feeds: None detected
• Known Campaigns: None
• Tor Exit/Proxy: No
• Spam Source: No
• Known Attacker: No

---

## NETWORK SERVICES & FINGERPRINTING

• Open Ports: 80/TCP (HTTP), 22/TCP (SSH)
• Web Server: Apache/2.4.41 (Ubuntu)
• HTTP Version: 1.1
• TLS Certificate: None observed
• DNS Resolution: No forward resolution / PTR records

---

## NEIGHBORHOOD ANALYSIS

Subnet: 169.239.183.0/24

• Abuse Density: 16.67% (moderate)
• Total Siblings: 6
• Active Siblings: 2
• Threat Siblings: 1
• Classification: Mostly clean

Neighbor Risk Distribution:

---

## OBSERVATION HISTORY (17 Signals)

• 2026-06-22: Listed on 8 DNSBLs with high-severity ratings (confidence: 0.85)
• 2026-06-17: Subnet analysis showed mostly_clean classification with inherited risk of 2
• 2026-06-17: HTTP fingerprint confirmed Apache/2.4.41 (Ubuntu) with no CSP/HSTS headers
• 2026-06-17: Geolocation inference placed IP in South Africa (confidence: 0.52)
• Operator Score: 0.1304 (Minimal)

---

## SOC RECOMMENDATIONS

1. Monitor DNSBL Listings: Investigate which of the 8 DNSBLs has the high-severity listing and assess if delisting is warranted

2. Subnet Correlation: Monitor threat sibling at 169.239.183.4 for correlated activity

3. Route Stability: Verify BGP route changes for 169.239.183.0/24 due to unstable prefix

4. No Immediate Block: Current risk score (25) does not warrant blocking without additional context

Action Priority: MEDIUM (monitor)

Recommended Actions: None (system generated empty recommendations)

---

*Intelligence generated from IPDebrief platform. Correlate with internal logs and threat feeds before taking action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.