18.97.5.11📋 Copy

# INTELLIGENCE BRIEFING: IP 18.97.5.11

## Executive Summary

IP address 18.97.5.11 is classified as low risk with an overall risk score of 25. The address belongs to Amazon Technologies Inc. (ASN 14618) within the AT-88-Z network block (18.32.0.0/11), located in Ashburn, Virginia. The IP operates as a cloud infrastructure service with no open ports detected and no active threat indicators.

## Ownership and Infrastructure

• Organization: Amazon Technologies Inc.
• Network Block: 18.32.0.0/11 (AT-88-Z)
• ASN: 14618 (Amazon Web Services)
• Classification: Cloud compute infrastructure, hosting provider
• Geolocation: United States, Virginia, Ashburn (39.04°N, -77.49°W)

## Network Role and Services

The IP is registered as cloud infrastructure with the following characteristics:

• Infrastructure Type: CloudCompute
• Connection Type: Not identified
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: Not detected
• HTTP Banner: Not detected

## DNS Analysis

• PTR Record: scanner-18-97-5-11.reposify.net
• Forward Resolution: Confirmed
• Forward Hostnames: scanner-18-97-5-11.reposify.net
• Domain: reposify.net

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not detected
• Threat Indicators: None identified
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Associations: None detected

## Control Plane and Routing

• Route Stability: Not stable (route changes: 0 in last 30 days)
• DNSBL Listings: 1 of 8 total lists
• BGP Prefix: 18.97.0.0/18
• Operator Score: 0.2609 (Basic)
• RPKI State: Not validated

## Neighborhood Analysis

The IP resides in subnet 18.97.5.0/24 with the following characteristics:

• Total Siblings: 23
• Active Siblings: 20
• Threat Siblings: 3
• Abuse Density: 0.1304 (13.04%)
• Classification: Mostly clean
• Inherited Risk Score: 5

Risk distribution across neighborhood:

• High Risk: 0
• Medium Risk: 2
• Low Risk: 19

## Historical Observations

18 observations recorded, with recent activity from 2026-08-05. Signal observations include:

• Geographic validation (Ashburn, VA)
• Traceroute analysis (30 hops, target not reached)
• Operator scoring (Basic classification)
• Overall profile assessment with moderate data sufficiency

## Related Entities

• DNS Associations: scanner-18-97-5-11.reposify.net (multiple associations)
• Network Associations: AT-88-Z (multiple associations)

## Recommendations

Based on the current risk profile and infrastructure classification:

• No immediate blocking recommended - IP operates within legitimate AWS infrastructure
• Monitor for behavioral changes - Route stability flag indicates potential routing changes
• DNSBL monitoring - One DNSBL listing detected; monitor for additional listings
• Neighbor awareness - 3 threat siblings detected in /24 subnet; monitor related IPs if suspicious activity observed

## Conclusion

IP 18.97.5.11 presents as a standard cloud infrastructure address with no immediate threat indicators. The low risk score, AWS infrastructure classification, and absence of open ports suggest legitimate cloud service operation. However, the presence of threat siblings in the same subnet warrants continued monitoring for potential coordinated activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.