199.195.251.168📋 Copy

# IP Intelligence Briefing: 199.195.251.168

Classification: Hosting Infrastructure | Risk Level: Low | Date: June 2026

## Executive Summary

IP 199.195.251.168 operates within a Yahoo-owned hosting environment on the Frantech/BuyVM network. The address presents low risk (score: 25/100) with no active threat indicators. The IP serves Yahoo Holdings Inc. web infrastructure, with one neighboring IP (199.195.251.119) showing elevated risk (49/100).

## Network Profile

## Infrastructure Analysis

Open Services:

• Port 443/TCP (HTTPS): Primary web service with ATS server fingerprint
• Port 22/TCP (SSH): SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11

TLS Certificate:

• Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
• Subject: CN=yahoo.com (Yahoo Holdings Inc.)
• Valid SANs: yahoo.com, tw.rd.yahoo.com, s.yimg.com, mbp.yimg.com, hk.rd.yahoo.com

DNS Configuration:

• DMARC: Present (p=reject, pct=100)
• SPF: Not configured
• TXT Records: 13 records observed
• DNSSEC: Validated

## Threat Indicators

Current Status: No active threat indicators

• Known attacker: False
• Tor exit node: False
• Known spam source: False
• Campaign matches: 0
• Blacklist count: 0

Control Plane:

• Route stability: Unstable
• RPKI state: Not evaluated
• Route changes (30d): 0
• Operator score: 0.1304 (Minimal)
• DNSBL listed: 1

## Observation History

Analysis of 24 signals reveals consistent infrastructure behavior:

• 2026-06-28: Confirmed hosting provider assignment (Frantech/BuyVM), no CDN/TOR/VPN characteristics
• 2026-06-23: HTTP/2 enabled, 404 response (ATS server), no HTTP Strict Transport Security
• 2026-06-20: DMARC reject policy active, DNSSEC operator score minimal

Temporal analysis indicates no persistent malicious activity (threat persistence: 0 days).

## Neighborhood Analysis (199.195.251.0/24)

Elevated Risk Neighbor:

• 199.195.251.119: Risk Score 49/100, Authority Score 50/100

## Recommended Actions

Firewall/Access Control:

• Permitted traffic patterns consistent with legitimate Yahoo hosting operations
• No immediate blocking required based on current risk profile

Monitoring Recommendations:

• Monitor for changes in TLS certificate subjects or SANs
• Track 199.195.251.119 for potential correlated activity
• Maintain awareness of DMARC policy enforcement

## Conclusion

The IP represents legitimate Yahoo-owned web infrastructure hosted on Frantech/BuyVM. Risk score of 25 reflects standard hosting provider classification with no active malicious indicators. The single DNSBL listing and geolocation validation anomaly (19ms RTT vs. 119.7ms minimum for 5,987km distance) warrant routine monitoring but do not indicate compromise. Focus attention on neighboring IP 199.195.251.119, which demonstrates elevated risk characteristics.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.