18.97.26.112📋 Copy

# IP Intelligence Briefing: 18.97.26.112

Classification: AWS Cloud Infrastructure

Risk Level: Low (Score: 25/100)

Date: 2026-08-06

---

## Executive Summary

IP 18.97.26.112 belongs to Amazon Technologies Inc. (ASN 14618) within the AT-88-Z network block. The IP is registered to Amazon Web Services cloud infrastructure, geolocated to Ashburn, Virginia. While the primary IP demonstrates low-risk characteristics, intelligence indicates one DNSBL listing and elevated threat signals in recent observations. The /24 neighborhood shows minimal abuse density with predominantly low-risk infrastructure.

---

## Infrastructure Profile

---

## Technical Observations

DNS Configuration:

• PTR Record: scanner-18-97-26-112.reposify.net
• Forward Resolution: Confirmed
• Hosted Domain: reposify.net
• SPF/DMARC: Configured

Control Plane:

• Origin ASN: 14618
• BGP Prefix: 18.97.0.0/18
• Route Stability: False
• DNSBL Status: Listed on 1 of 8 feeds
• RPKI State: Not validated

Services:

• Open Ports: None (Firewalled)
• TLS Certificate: None
• HTTP Banner: None

---

## Threat Intelligence

Threat Indicators:

• Abuse Confidence Score: Not available
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 1 (DNSBL)
• Threat Feeds: Empty

Historical Signals (16 Observations):

• Recent BGP routing observations from 2026-08-06
• AlienVault OTX signals indicate threat presence with 17 associated pulses
• Multiple geolocation consensus sources confirming US location
• Operator Score: 0.2609 (Basic)
• No persistent malicious behavior detected

Relationships:

• DNS Association: scanner-18-97-26-112.reposify.net
• Network Association: AT-88-Z

---

## Neighborhood Analysis (18.97.26.0/24)

Notable Neighbor:

• 18.97.26.99: Risk Score 50 (Medium), Authority Score 60

Most sibling IPs (18.97.26.12, 18.97.26.18, 18.97.26.22, etc.) maintain consistent risk scoring of 25 with authority scores of 60, indicating stable AWS infrastructure deployment patterns.

---

## SOC Recommendations

Action Required: Monitor

Rationale:

1. Primary IP (18.97.26.112) is legitimate AWS cloud infrastructure with low-risk profile

2. One DNSBL listing requires investigation of listing source

3. Recent threat pulses in observation history warrant correlation with known campaigns

4. Single medium-risk neighbor (18.97.26.99) should be reviewed for potential coordinated activity

Recommended Actions:

• Verify DNSBL listing reason and remove if erroneous
• Monitor for traffic patterns matching AlienVault OTX pulse signatures
• Review inbound connection logs for anomalies from this IP range
• Consider adding 18.97.26.99 to watch list due to elevated risk score

No Immediate Blocking Recommended

---

Status: Clear for business operations with monitoring

Intel Confidence: Medium (based on limited threat feed data)

Next Review: 30 days or upon detection of behavioral change

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.