170.253.147.12📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 170.253.147.12/32

Classification: High Risk - Residential Broadband

Date: 2026-07-27

Analyst: IPDebrief SOC Intelligence

## EXECUTIVE SUMMARY

IP 170.253.147.12 is a residential broadband endpoint operating within the MAXXSOUTH-BROADBAND network (ASN 46687) in Starkville, Mississippi. The IP registers a risk score of 80 (High Risk), primarily driven by DNSBL reputation metrics despite showing no active malicious campaigns or known attacker associations. The endpoint presents an exposed SSH service and moderate DNSBL listing presence, warranting monitoring but not immediate blocking.

## OWNERSHIP & GEOLOCATION

• ASN: 46687 (BCI Mississippi Broadband, LLC)
• Network Name: MAXXSOUTH-BROADBAND
• CIDR Block: 170.253.128.0/17
• Registrant: ARIN
• Geolocation: United States, Mississippi, Starkville (2500km accuracy radius)
• Infrastructure Type: Residential
• Network Role: Single-Service Host

## NETWORK SERVICES & EXPOSURE

• Open Ports: TCP/22 (SSH)

- Banner: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3.ui1

• DNS Resolution: cm-170-253-147-12.maxxsouthbb.net (forward confirmed)
• Reverse DNS: cm-170-253-147-12.maxxsouthbb.net
• SSL/TLS: None detected
• HTTP: No web service detected

## THREAT INDICATORS

• Risk Score: 80 (High Risk)
• DNSBL Listings: 5 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected
• Persistence: No persistent malicious activity observed
• Threat Feeds: Empty

## NETWORK CONTEXT

• Subnet: 170.253.147.0/24
• Abuse Density: 0 (no abuse detected in /24)
• Neighbor Threats: 0 (no sibling IPs flagged)
• Route Stability: False (route changes observed in 30-day window)
• RPKI State: Not evaluated
• Control Plane Status: Basic operator score (0.2609)

## OBSERVATION HISTORY

• Total Observations: 18 signals recorded
• Most Recent: 2026-07-27 06:47 UTC
• Classification History: Consistently identified as residential
• Ownership Stability: No ownership changes detected
• Threat Persistence: 0 days (no persistent threat pattern)
• Correlated IPs: 0
• Campaign Matches: 0

## RELATIONSHIP ANALYSIS

• DNS Associations: cm-170-253-147-12.maxxsouthbb.net (multiple entries)
• Network Associations: MAXXSOUTH-BROADBAND (same network)
• No external entity relationships detected
• No certificate associations

## RECOMMENDED ACTIONS

Based on the risk profile and observed behavior:

1. Monitoring: Implement traffic monitoring for outbound connections from this IP. The SSH exposure on port 22 represents a potential attack vector.

2. DNSBL Reputation: Investigate the 5 DNSBL listings. While not indicative of active malicious behavior, this may indicate historical reputation issues or false positives from residential broadband operators.

3. Firewall Rules: Consider rate limiting or geo-based filtering for inbound SSH connections from this residential IP range.

4. Threat Hunting: No active campaigns detected. No immediate blocking recommended, but maintain awareness of DNSBL reputation trends.

## THREAT INTELLIGENCE ASSESSMENT

This IP represents a residential broadband endpoint with elevated reputation risk due to DNSBL listings. The absence of active malicious indicators, Tor usage, known attacker associations, and campaign correlations suggests the high risk score is reputation-based rather than activity-based. The exposed SSH service on port 22 is the primary technical concern. Network isolation (no neighboring threats) and stable residential classification support a monitoring approach over aggressive blocking.

Recommendation: Monitor with rate-limiting controls. No immediate blocking required pending DNSBL investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.