176.65.149.96
IP Intelligence Briefing: 176.65.149.96
Date: 2026-06-11
---
**1. Core Risk Profile**
- Risk Score: 70 (High Risk)
- Threat Indicators:
- Tor exit node activity observed.
- Open ports: HTTP (80), HTTPS (443), SSH (22).
- TLS certificate linked to `www.zlr6cslnagi.net` (self-signed).
- Ownership:
- ASN: 51396 (Admin, RIPE).
- Geolocation: Netherlands (Limburg, Eygelshoven).
- Network Role: Web server with SSH access.
---
**2. Observational History**
- Recent Activity (2026-06-11):
- TLS scan detected SSH version `OpenSSH_9.2p1` and nginx `1.22.1`.
- No known campaigns or spam sources.
- Tor exit indicators persist, but no direct malicious activity logged.
- Historical Trends:
- Stable ownership (no recent changes).
- Low threat persistence (1 observation in 30 days).
---
**3. Relationships & Network Context**
- DNS Associations:
- PTR hostname: `176.65.149.96.ptr.pfcloud.network`.
- Linked to domain `pfcloud.network` (SPF/DKIM configured).
- Network Subnet:
- Subnet: `176.65.149.0/24` (abuse density: 20%).
- Neighboring IPs show mixed risk: 2 medium-risk siblings, 7 low-risk.
---
**4. Neighborhood Analysis**
- Subnet Risk: Mostly clean, but 2 IPs in the same /24 subnet show medium risk.
- Key Neighbors:
- `176.65.149.200` (riskScore: 25), `176.65.149.213` (riskScore: 25).
- `176.65.149.124` (riskScore: 25) with higher authority score (60).
---
**5. Recommendations**
- Monitoring:
- Continuously monitor Tor exit activity and TLS certificate validity.
- Validate DNS records and ensure SPF/DKIM alignment for `pfcloud.network`.
- Mitigation:
- Block Tor exit nodes in firewall rules (e.g., `iptables -A INPUT -s 176.65.149.96 -j DROP`).
- Restrict SSH access to trusted sources.
- Network Segmentation:
- Isolate high-risk subnets (`176.65.149.0/24`) to limit lateral movement.
---
Note: This IP exhibits characteristics of a compromised or semi-malicious host. Further investigation into its Tor exit activity and network relationships is advised.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Admin |
| ASN | AS51396 |
| Network Name | — |
| CIDR Block | 176.65.149.0/24 |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 176.65.149.96.ptr.pfcloud.network |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 176.65.149.96.ptr.pfcloud.network |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | nginx/1.22.1 |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7 |
🔐 TLS Certificate
| SANs | None |
| Valid From | 2026-04-20T00:00:00+00:00 |
| Valid Until | 2026-08-24T00:00:00+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 126 days |
| Serial Number | 00C6E1BA8E0C9EC453 |
| Thumbprint | AE875FBDCB8E133DD021EACBBED0701306320622 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 30% | 2 | 4 |
| routing | 27% | 2 | 3 |
| services | 32% | 2 | 3 |
| ownership | 37% | 3 | 8 |
| reputation | 26% | 1 | 3 |
| geolocation | 30% | 2 | 3 |
| Overall | 30% | 12 | 24 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-22 13:35:44 UTC |
| Last Seen | 2026-06-26 21:06:52 UTC |
| Profile Built | 2026-06-27 15:59:21 UTC |
| Data Freshness | Live |
| Signal Types | 30 |
| Total Observations | 61 |
Full dossier details are available via our API.