18.97.5.92📋 Copy

# IP INTELLIGENCE BRIEFING: 18.97.5.92/32

## Executive Summary

IP address 18.97.5.92 is classified as Low Risk (Risk Score: 25) and represents legitimate Amazon Web Services cloud infrastructure. No active threat indicators or malicious activity patterns were identified. The IP is part of a low-abuse-density subnet with predominantly clean peer addresses.

---

## Infrastructure Profile

---

## Network Role & Services

• Service Purpose: Single-Service Host
• DNS Resolution: scanner-18-97-5-92.reposify.net
• Open Ports: TCP/80 (HTTP)
• Server Banner: Reposify
• HTTP Version: 1.0
• TLS Certificate: None detected
• Email Authentication: SPF and DMARC configured

---

## Threat Assessment

Risk Indicators: None

• Blacklist Count: 0
• Threat Feeds: Empty
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Abuse Confidence Score: Not calculated

DNSBL Listings: 1 of 8 total lists (non-critical)

---

## Neighborhood Analysis (18.97.5.0/24)

The /24 subnet exhibits low abuse density (0.1739) with a "mostly_clean" classification:

• Total Siblings: 23
• Active Siblings: 22
• Threat Siblings: 4
• Risk Distribution: 0 High, 2 Medium, 19 Low

Notable Neighbors:

• 18.97.5.34, 18.97.5.35: Risk Score 40 (elevated)
• 18.97.5.11, 18.97.5.22, 18.97.5.27, 18.97.5.30, 18.97.5.32, 18.97.5.36: Risk Score 25
• Multiple peers (18.97.5.69, 18.97.5.70, 18.97.5.90, 18.97.5.108): Risk Score 0

---

## Historical Signals

Observation Count: 24 signals over monitoring period

Key Historical Events:

• 2026-08-05: Recent subnet abuse density signal (0.1739), control plane operator score 0.2609
• 2026-08-05: HTTP fingerprinting confirmed (Reposify server, HTTP/1.0, TTFB: 61ms)
• 2026-07-30: Geolocation validation attempted (ICMP blocked, distance: 6312.5km)

Temporal Stability: No ownership changes detected. Not persistently malicious.

---

## Relationship Graph

• DNS Associations: scanner-18-97-5-92.reposify.net (multiple records)
• Network Associations: AT-88-Z (18.32.0.0/11)

---

## Recommended Actions

Current Status: No immediate defensive actions recommended.

The IP presents a low-risk profile consistent with legitimate AWS cloud infrastructure. Standard monitoring practices apply. No firewall rules or blocking measures warranted at this time.

Monitoring Notes:

• Subnet shows 4 threat siblings; maintain awareness of elevated-risk peers (18.97.5.34, 18.97.5.35)
• HTTP-only service (no TLS) may warrant application-layer inspection if traffic is observed

---

Intel Compiled: IPDebrief Platform

Classification: Defensive Security Intelligence

Status: Active Monitoring Recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.