199.45.154.115📋 Copy

IP Intelligence Briefing: 199.45.154.115

Date: June 2, 2026

1. Risk Profile

• Risk Score: 65 (Moderate Risk)
• Ownership: Censys, Inc. (ASN 398722)
• Geolocation: New York, NY, US (latitude 39.83, longitude -98.58)
• Network Role: Firewalled system with no open ports or services detected.

2. Threat Indicators

• No malicious indicators, blacklists, or campaigns linked.
• DNS resolves to `115.154.45.199.censys-scanner.com`, a Censys scanner hostname.
• Subnet abuse density: 70.83% (high risk), but IP itself is not malicious.

3. Observation History

• TLS Scans: Detected on June 2, 2026 (confidence 0.70).
• DNS Lookups: Resolved to `censys-scanner.com` (3 listings across 8 threat feeds).
• Network Analysis: Subnet `199.45.154.0/24` shows 48 IPs, 6 active, 34 flagged as high-risk.

4. Relationships

• Direct DNS association with `censys-scanner.com`.
• Same subnet (`CENSY`) links to 21 IPs, suggesting a coordinated scanning or testing network.

5. Neighborhood Analysis

• Subnet: `199.45.154.115/24`
• Neighbor Risk: 47 IPs (44 moderate, 3 high-risk).
• Abuse Density: 70.83% (high), but IP itself is not malicious.

6. Recommendations

• Monitor Subnet: High abuse density in the subnet warrants closer scrutiny for lateral movement or coordinated activity.
• Verify DNS: Confirm `censys-scanner.com` is legitimate, as it may be a benign research tool.
• Baseline Activity: Track TLS scans and DNS queries for anomalies, as the IP’s network role is unclear.

Conclusion:

The IP is likely part of Censys’s infrastructure, possibly a scanner or research asset. While the subnet shows high abuse density, the IP itself does not exhibit malicious behavior. SOC teams should monitor for unusual traffic patterns or deviations from the observed baseline.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.