18.97.26.108📋 Copy

# IP INTELLIGENCE BRIEFING: 18.97.26.108/32

## Executive Summary

IP 18.97.26.108 is classified as Moderate Risk (Risk Score: 40/100). The address belongs to Amazon Web Services cloud infrastructure in Ashburn, Virginia, with associated DNS hostname scanner-18-97-26-108.reposify.net. No direct threat indicators detected, though the /24 subnet exhibits elevated abuse density (61.54%).

## Ownership and Infrastructure

## Threat Assessment

• Risk Score: 40/100 (Moderate Risk)
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Campaign Association: None detected

## Network Context and Neighborhood

• Subnet: 18.97.26.0/24
• Abuse Density: 0.6154 (High Abuse Classification)
• Total Siblings: 13 IPs
• Active Siblings: 11 IPs
• Threat Siblings: 8 IPs
• Inherited Risk: 20/100

The subnet shows significant activity with 8 of 13 neighbors flagged as threat sources, indicating this is an active cloud infrastructure block with mixed legitimate and potentially malicious endpoints.

## DNS and Service Analysis

• PTR Record: scanner-18-97-26-108.reposify.net
• Forward Resolution: Confirmed (reposify.net)
• Services: No open ports detected
• Server Fingerprint: Reposify
• HTTP Status: 200
• Email Authentication: SPF and DMARC records present

## Historical Observations

26 observations recorded. Recent signals (June 2026) confirm:

• Cloud infrastructure classification (AWS)
• Consistent Ashburn, VA geolocation
• One AlienVault OTX signal flagged "has_threats": true with 12 associated pulses
• One operator-level signal labeled "Basic" (0.2609 score)

## Relationship Graph

54 relationships identified:

• DNS Associations: scanner-18-97-26-108.reposify.net
• Network Associations: AT-88-Z (multiple entries)

## Recommended Security Actions

Based on risk profile, the following rules are recommended:

## Analyst Assessment

IP 18.97.26.108 represents AWS cloud infrastructure with moderate risk classification. The absence of open services and threat indicators suggests this may be a legitimate cloud endpoint or monitoring tool. However, the elevated neighborhood abuse density warrants caution. Blocking is recommended as a precautionary measure, particularly given 1 DNSBL listing and the subnet's high abuse classification. SOC teams should correlate with other indicators (e.g., source port patterns, request frequency) before implementing permanent blocks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.