185.157.223.17📋 Copy

IP Intelligence Briefing: 185.157.223.17

Date: 2026-06-16

---

**1. Core Profile**

• Risk Score: 80 (High Risk)
• Ownership: Glesys AB Support (AS42708)
• Geolocation: Falkenberg, Halland County, Sweden (SE)
• Network Role: Web server (ports 80/443/22 open; Traefik reverse proxy)
• Threat Indicators:

- Listed in 4/8 DNSBLs (moderate abuse risk).

- Self-signed TLS certificate (no HSTS/CSP headers).

- No known malicious campaigns or spam sources.

---

**2. Observation History**

• Recent Activity (June 16, 2026):

- Flagged in 4 DNSBLs (high-severity listings).

- DNS resolution to `strmonitor.com` (SPF/DMARC configured but no valid certificate).

- TLS handshake shows no HTTP/2 support (despite HTTP/2.0 header).

• Longer-Term Trends:

- Stable ownership (no recent changes).

- No persistent malicious behavior detected.

---

**3. Relationships**

• DNS Associations:

- Linked to `strmonitor.com` (multiple DNS records).

• Network Affiliation:

- Subnet `185.157.223.0/24` (Glesys customer network).

• Certificates:

- Self-signed Traefik certificate with SANs pointing to internal domains.

---

**4. Neighborhood Analysis**

• Subnet: `185.157.223.0/24`
• Abuse Density: 0% (no malicious neighbors).
• Neighbors: No active IPs in the subnet (isolated host).

---

**5. Actionable Insights**

• Monitor: The self-signed certificate and lack of HTTP/2 support suggest misconfiguration. Verify if `strmonitor.com` is legitimate.
• Investigate: Cross-check DNSBL listings with threat intelligence feeds to confirm abuse context.
• Secure: Ensure Traefik is configured with valid certificates and HSTS headers.
• Isolate: Given the isolated subnet, consider firewall rules to restrict access to this IP.

Recommended Tools: Use `ipdebrief_actions` to generate firewall rules for blocking DNSBL listings.

---

*End of Briefing*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.