172.252.13.101📋 Copy

# IP INTELLIGENCE BRIEFING: 172.252.13.101/32

Classification: MODERATE RISK (Score: 65/100)

Report Date: 2026-07-27

Analysis Period: Single observation window

---

## EXECUTIVE SUMMARY

IP address 172.252.13.101 is a web server endpoint operating on private network block 172.252.13.0/24. The asset demonstrates elevated risk characteristics due to moderate threat scoring (65/100), incomplete security header implementation, and geolocation data inconsistencies. No active malicious indicators detected at time of analysis, but monitoring recommendations warranted.

---

## TECHNICAL PROFILE

Network Identity

• IP Address: 172.252.13.101/32
• ASN: 53850
• Organization: Private Customer
• CIDR Block: 172.252.13.0/24
• Network Classification: Web Server

Service Fingerprint

• HTTP/HTTPS: nginx/1.24.0 (Ubuntu)
• Application Framework: Next.js
• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• TLS Certificate: Let's Encrypt (CN=myparentbridge.com)

---

## GEOLOCATION ANALYSIS

Reported Location: California, Los Angeles, US

Geolocation Consensus: FALSE

Critical Finding: RTT measurement violation detected. Observed RTT: 110.2ms average. Minimum possible RTT for reported distance (9,014 km): 180.3ms. This discrepancy indicates either:

• Inaccurate geolocation database data
• Potential routing manipulation
• Spoofed or falsified location information

---

## THREAT ASSESSMENT

Risk Score: 65/100 (Moderate Risk)

• Provider Score: 0
• Authority Score: 0
• Blacklist Count: 0
• Known Campaigns: None detected

Threat Indicators Status:

• Tor Exit Node: FALSE
• Known Attacker: FALSE
• Spam Source: FALSE
• DNSBL Listings: 3 of 8 total lists

Historical Analysis (17 Observations)

Recent signal observations show consistent web server behavior with no escalation of threat activity. No persistent malicious patterns observed across observation window.

---

## NEIGHBORHOOD INTELLIGENCE

Subnet: 172.252.13.0/24

Abuse Density: 0

Total Siblings: 1

Active Threat Siblings: 0

Neighbor Analysis:

• 172.252.13.90: Risk Score 0, Authority Score 50

The /24 subnet demonstrates minimal abuse activity, suggesting isolated risk profile for target IP.

---

## RELATIONSHIP MAPPING

Identified Relationships:

• Same Network: NET-172-252-13-0-24

No organizational, hostname, or certificate-based relationships detected beyond network-level association.

---

## SECURITY ACTIONS RECOMMENDATIONS

Monitoring

• Priority: HIGH
• Action: Increase logging verbosity and review recent activity from this IP
• Rationale: Elevated risk score (65/100) warrants enhanced observation

Firewall Rules

---

## SOC ANALYST NOTES

Key Concerns

1. Geolocation Inconsistency: 25%+ RTT discrepancy suggests data quality issues; may indicate routing anomalies or spoofing

2. Incomplete Security Posture: Missing HSTS, CSP, and proper DNS/email authentication (SPF/DMARC)

3. SSH Exposure: Port 22 open to external traffic increases attack surface

Recommended Additional Verification

• Cross-reference with internal network logs for this IP
• Validate TLS certificate validity and expiration
• Review connection patterns against baseline behavior
• Confirm network ownership and authorization status

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.