18.97.19.160📋 Copy

# IP Intelligence Briefing: 18.97.19.160

## Executive Summary

Target IP 18.97.19.160 is classified as Low Risk with a risk score of 0. The address is provisioned infrastructure hosted within Amazon Web Services (AWS) in Ashburn, VA. No active threat indicators or malicious activity were observed. No immediate security actions required.

## Technical Profile

• IP Address: 18.97.19.160
• ASN: AS14618 (Amazon Technologies Inc.)
• Organization: AT-88-Z
• CIDR Block: 18.32.0.0/11
• Location: Ashburn, VA, US (39.04°N, -77.49°W)
• Network Classification: CloudCompute, Cloud Infrastructure
• DNS: scanner-18-97-19-160.reposify.net

## Service Analysis

• Open Ports: TCP/80 (HTTP)
• Server Banner: Reposify
• Status Code: 200
• HTTP Version: 1.0
• Security Headers: HSTS not present, CSP not present
• Email Auth: SPF and DMARC records present on associated domain

## Threat Assessment

• Reputation Score: 0 (Low Risk)
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not applicable
• Threat Feeds: None detected

## Historical Observation

Analysis of 26 historical observations from 2026-08-11 indicates consistent infrastructure behavior. Signals include HTTP service fingerprinting with consistent "Reposify" server identification. No persistent malicious activity detected. Threat persistence days: 0.

## Neighborhood Analysis

The /24 subnet (18.97.19.0/24) contains 28 sibling IP addresses with the following risk distribution:

• High Risk: 0
• Medium Risk: 0
• Low Risk: 27

Subnet abuse density: 0.0 (Clean). This confirms the IP resides within a benign AWS infrastructure segment.

## Related Entities

• Hostname: scanner-18-97-19-160.reposify.net
• Network: AT-88-Z (18.32.0.0/11)
• Route Stability: False (route changes observed)
• Route Changes (30d): 0

## Recommended Actions

No security actions recommended. The IP demonstrates benign characteristics consistent with AWS cloud infrastructure. The hostname pattern ("scanner-*") and reposify.net association indicate this is legitimate AWS monitoring or service infrastructure, not malicious scanning activity.

Firewall Configuration

No firewall rules required. Permissive policy may be applied.

---

Analyst Notes: This IP represents normal AWS cloud infrastructure. The "scanner" hostname prefix is common for AWS service monitoring and does not indicate malicious reconnaissance. The absence of threat indicators, combined with clean neighborhood metrics, supports benign classification.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.