18.97.26.64📋 Copy

# IP INTELLIGENCE BRIEFING: 18.97.26.64/32

Classification: Moderate Risk | Date: June 21, 2026

Analysis Source: IPDebrief Intelligence Platform

---

## EXECUTIVE SUMMARY

IP 18.97.26.64 is a cloud infrastructure endpoint operated by Amazon Technologies Inc. (AS14618) in Ashburn, Virginia. The address carries a moderate risk score (40/100) with no active threat indicators. The IP is associated with reposify.net DNS infrastructure and operates within a high-abuse-density subnet (18.97.26.0/24).

---

## OWNERSHIP & INFRASTRUCTURE

• Organization: Amazon Technologies Inc.
• ASN: AS14618 (Amazon Web Services)
• CIDR Block: 18.32.0.0/11
• Network Classification: CloudCompute / Hosted
• Infrastructure Type: Amazon Web Services Cloud
• Geolocation: Ashburn, VA, US (39.04°N, -77.49°W)

---

## NETWORK CONTEXT

Subnet Analysis (18.97.26.0/24):

• Total Siblings: 15 IPs in /24 subnet
• Abuse Density: High (0.5833)
• Risk Distribution: 7 medium-risk, 8 low-risk neighbors
• Notable Neighbor IPs: 18.97.26.18 (risk 40), 18.97.26.41 (risk 50), 18.97.26.106 (risk 50)

Network Role:

• Is Cloud: Yes
• Is Hosting: Yes
• Services: Firewalled / No active services
• Anycast: No

---

## THREAT INTELLIGENCE

Current Risk Score: 40 (Moderate)

Threat Indicators: None detected

Blacklist Status: 0 known blacklists

Campaign Association: None identified

Tor/Proxy/VPN: Not identified

Control Plane:

• DNSBL Listed: 1 of 8 total lists
• Route Stability: False
• RPKI State: Not evaluated
• Route Changes (30d): 0

---

## DNS & RESOLUTION

• PTR Hostname: scanner-18-97-26-64.reposify.net
• Domain: reposify.net
• Forward Resolution: 1 hostname
• Email Auth: SPF record present, DMARC record present
• HTTPS: No TLS certificate, no HTTP services detected

---

## OBSERVATION HISTORY (22 SIGNALS)

Recent signals indicate:

• Geolocation inference consistent (Ashburn, VA)
• Cloud infrastructure confirmed
• Threat pulse signals from AlienVault OTX (19 pulses)
• Operator score: 0.2609 (Basic classification)
• No persistent malicious activity observed

---

## RECOMMENDED ACTIONS

IMMEDIATE:

1. Monitor – No immediate blocking required. Risk score below high-risk threshold.

2. Investigate – Review inbound traffic patterns if unusual activity detected.

3. Context – Cross-reference with reposify.net domain reputation.

FIREWALL RULES (OPTIONAL):

```bash

# iptables

iptables -A INPUT -s 18.97.26.64 -j DROP

# nftables

nft add rule inet filter input ip saddr 18.97.26.64 drop

# Cloudflare WAF

# Block 18.97.26.64 — IPDebrief risk score 40

# AWS WAF

# Addresses: 18.97.26.64/32

```

NOTE: These recommendations are probabilistic. Review with other signals before blocking.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.