185.15.169.38📋 Copy

# IP INTELLIGENCE BRIEFING: 185.15.169.38/32

Classification: Low Risk | Reputation Score: 30 (0-100) | Report Date: Current

---

## EXECUTIVE SUMMARY

IP 185.15.169.38 presents as a low-risk web hosting endpoint operated by DONATO CONTE within the METIS-V4-USER subnet (185.15.169.0/24). The IP hosts a lighttpd web server with standard HTTP/HTTPS and SSH services. No active threat indicators detected. Recommended monitoring level: Standard.

---

## OWNERSHIP & GEOLOCATION

• Organization: DONATO CONTE
• ASN: 57558
• Network: METIS-V4-USER (185.15.169.0/24)
• RIR: RIPE
• Registered Location: Tito, Basilicata, Italy
• Geolocation Confidence: Moderate (2 signal sources, 750km accuracy radius)

---

## NETWORK SERVICES & INFRASTRUCTURE

• Active Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• Web Server: lighttpd/1.4.54
• Reverse DNS: host038-169-015-185.retemetis.net
• SSL Certificate: Issued by Ubiquiti Networks Inc., CN=UBNT-60:22:32:D8:35:F5 (self-signed enterprise cert)
• Email Authentication: None configured (no SPF/DMARC records)

Analysis: The Ubiquiti certificate suggests this endpoint may be a Ubiquiti networking device rather than traditional web hosting. SSH access enabled.

---

## THREAT INTELLIGENCE

• Abuse Confidence Score: Not calculated
• Blacklist Status: 0/8 DNSBL lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Attribution: None identified
• Threat Persistence: 0 days observed

---

## SUBNET CONTEXT (185.15.169.0/24)

• Total Siblings: 47 IPs
• Abuse Density: 0.128 (moderate)
• Risk Distribution: 6 High (80), 35 Medium (30-55), 6 Low (<30)
• Neighborhood Risk: Elevated relative to target IP (6 high-risk neighbors including 185.15.169.17, 185.15.169.32, 185.15.169.81, 185.15.169.122, 185.15.169.146, 185.15.169.223)

---

## OBSERVATION HISTORY

• Total Observations: 21 signals
• Recent Activity: 2026-07-27 (HTTP, geolocation, DNS signals)
• Ownership Stability: No ownership changes recorded
• Persistence: No persistent malicious behavior detected

---

## CONTROL PLANE

• BGP Prefix: 185.15.168.0/22
• Route Stability: Active (0 route changes in 30 days)
• DNSSEC: Valid
• IRR Consistency: Not evaluated

---

## SOC RECOMMENDATIONS

IMMEDIATE ACTIONS

• Monitoring: Standard baseline monitoring recommended
• Firewall Rules: No blocking required based on current risk profile
• Alerting: Monitor for behavioral changes in service patterns (HTTP/SSH)

INVESTIGATION TRIGGERS

Investigate this IP if:

• Port 22 (SSH) shows abnormal login attempts
• Traffic volume exceeds baseline thresholds
• Certificate verification fails (Ubiquiti cert mismatch expected)
• Neighboring high-risk IPs (185.15.169.17, 185.15.169.32, 185.15.169.81) exhibit correlated activity

---

Analyst Notes: The Ubiquiti certificate and single-host naming convention suggest this is likely a network device endpoint rather than traditional web hosting. SSH access is enabled, which is acceptable for management interfaces but warrants monitoring for unauthorized access attempts. Subnet abuse density is moderate; consider correlating with high-risk neighbors for potential coordinated activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.