18.209.86.113📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Subject: 18.209.86.113/32

Classification: Low Risk Infrastructure IP

Date: 2026-06-16

Analyst: IPDebrief SOC Team

---

## EXECUTIVE SUMMARY

IP 18.209.86.113 is a low-risk infrastructure address belonging to Amazon Web Services (AWS). The IP is classified as a cloud compute resource with no active threat indicators. No immediate blocking action is recommended for defensive security operations.

---

## OWNERSHIP & ATTRIBUTION

---

## RISK ASSESSMENT

Overall Risk Score: 25/100 (Low Risk)

Threat Indicators: None detected

• Not a Tor exit node
• Not a known attacker
• Not a spam source
• Zero blacklist entries

---

## NETWORK PROFILE

Network Role: AWS Cloud Infrastructure

• Connection Type: Cloud service
• Hosting: Yes
• CDN/VPN/Proxy: No
• Bogon/Anycast: No

DNS Resolution:

• PTR Hostname: keeper-us-east-1d.mxtoolbox.com
• Forward Resolution: keeper-us-east-1d.mxtoolbox.com
• Forward Confirmed: Yes

Services: No open ports detected (firewalled infrastructure)

---

## GEOLOCATION VALIDATION

---

## HISTORICAL OBSERVATIONS

Total Observations: 23 signals

Recent Activity (2026-06-16):

• Port scanning activity detected
• Blacklist listing observed (8 total lists, 1 high severity)
• DNS and routing stability signals
• ASN assignment confirmed (7,524 days)

Temporal Analysis:

• Ownership changes: 0
• Threat persistence days: 0
• Persistently malicious: No
• Threat observation count: 0

---

## RELATIONSHIP GRAPH

Total Relationships: 25

Primary Associations:

• DNS: keeper-us-east-1d.mxtoolbox.com (repeated associations)
• Network: AT-88-Z (18.209.86.0/24 subnet)

No malicious entity relationships detected.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 18.209.86.0/24

• Abuse Density: 0% (Clean)
• Classification: Clean
• Active Siblings: 0
• Threat Siblings: 0
• Total Siblings: 1

Assessment: No neighboring IPs show malicious activity.

---

## RECOMMENDED ACTIONS

Rationale: This IP represents AWS infrastructure with no active threat indicators. Standard defensive posture for cloud provider IPs applies.

---

## INTELLIGENCE NARRATIVE

IP 18.209.86.113 is a legitimate AWS infrastructure address located in Ashburn, Virginia. The IP resolves to mxtoolbox.com email services and operates within the 18.32.0.0/11 AWS block. Historical analysis shows consistent ownership by Amazon Technologies Inc. since 2005 with no malicious activity patterns. The subnet demonstrates zero abuse density and no neighboring threat indicators. A single blacklisting event was observed on 2026-06-16 across 8 total lists, with high severity classification on one listing; however, the overall risk score remains low (25/100). No open ports are detected, consistent with firewall-hardened AWS infrastructure. No firewall blocking is recommended for this address. SOC teams should treat this as benign AWS traffic unless specific campaign indicators emerge.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.