2.58.172.169📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 2.58.172.169/32

Classification: LOW RISK / HOSTING INFRASTRUCTURE

Date: 2026-06-28

Risk Score: 25/100

---

## EXECUTIVE SUMMARY

IP 2.58.172.169 is a low-risk cloud hosting endpoint operated by OVH (ASN 16276). The IP hosts web services for the domain tokendirectory.wiki and exhibits standard hosting infrastructure characteristics. No active threat indicators or malicious campaigns have been detected.

Key Findings:

• Risk Score: 25 (Low Risk)
• Provider: OVH Cloud Computing
• Infrastructure: Cloud Hosting (nginx/1.24.0, Ubuntu)
• Geolocation: GB (UK) / Frankfurt am Main
• TLS Certificate: CN=tokendirectory.wiki
• DNSBL Listed: 1 of 8 lists

---

## NETWORK CLASSIFICATION

---

## SERVICES & ENDPOINTS

Open Ports:

• TCP/80 (HTTP)
• TCP/443 (HTTPS)

Server Fingerprint:

• Server: nginx/1.24.0 (Ubuntu)
• Framework: Next.js
• HTTP Version: 1.1
• Time-to-First-Byte: 586ms

TLS Certificate:

• Issuer: CN=tokendirectory.wiki
• Subject: CN=tokendirectory.wiki
• SANs: tokendirectory.wiki, www.tokendirectory.wiki
• Self-Signed: No

---

## THREAT INDICATORS

Active Threat Signals: None detected

Assessment:

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: No

Control Plane Status:

• DNSBL Listed: 1 of 8 lists
• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable
• Route Changes (30d): 0

---

## NEIGHBORHOOD ANALYSIS (2.58.172.0/24)

Subnet Classification: Mostly Clean

Abuse Density: 0.6667 (66.7%)

Neighbor IPs:

• 2.58.172.79: Risk Score 25 (Low)
• 2.58.172.222: Risk Score 25 (Low)

Assessment: The subnet shows elevated abuse density (0.6667) with 2 of 3 active siblings exhibiting threat indicators. However, this IP itself maintains a low risk profile. The neighborhood context suggests potential shared infrastructure risks but no direct correlation to this specific endpoint.

---

## OBSERVATION HISTORY

Total Observations: 19 signals

Recent Activity:

• 2026-06-28: Cloud hosting profile consistent (OVH, not Tor/VPN/Proxy)
• 2026-06-20: HTTP fingerprinting confirms nginx/1.24.0 with Next.js framework

Temporal Assessment: No significant changes in ownership or threat signals observed over the observation period. The IP has maintained consistent hosting infrastructure characteristics.

---

## RELATIONSHIP GRAPH

Total Relationships: 22

Key Connections:

• Same Network: NET-2-58-172-0-24 (22 entries)
• No external organization, hostname, or certificate correlations identified

---

## RECOMMENDED ACTIONS

Current Status: No immediate blocking recommendations required

Monitoring Considerations:

1. Monitor for changes in DNSBL listing status (currently 1 of 8 lists)

2. Watch neighborhood abuse density trends (2.58.172.0/24 at 66.7% abuse density)

3. Verify domain (tokendirectory.wiki) legitimacy if receiving traffic from this IP

4. Standard logging for inbound/outbound connections recommended

Firewall Rules: None required at this time (low-risk profile)

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.