2.58.172.79📋 Copy

## Intelligence Briefing: IP 2.58.172.79

Classification: LOW RISK | Report Date: Current | Risk Score: 25/100

---

EXECUTIVE SUMMARY

IP 2.58.172.79 is a cloud-hosted infrastructure address assigned to OVH SAS (AS16276) with a low overall risk profile. The IP operates within the 2.58.172.0/24 CIDR block and shows no active malicious indicators. However, geolocation inconsistencies and historical ASN changes warrant monitoring.

---

NETWORK ATTRIBUTES

• Provider: OVH SAS (AS16276)
• Infrastructure Type: Cloud Compute
• Network Role: Hosting provider with firewall-enabled configuration
• Geolocation: Primary consensus indicates GB/London region; secondary signals suggest DE/Frankfurt am Main (geoConsensus: false, accuracy radius 750km)
• DNS Configuration: No PTR record, no forward resolution, no email authentication (SPF/DMARC) records present

---

THREAT INDICATORS

• Risk Score: 25 (Low)
• Known Campaigns: None detected
• Threat Feeds: No blacklist matches
• Blacklist Status: Listed on 1 of 8 DNSBL sources
• Malicious Classifications: Not a Tor exit node, not a known attacker, not a spam source
• Active Threat Indicators: None

---

OBSERVATION HISTORY

Historical analysis of 20 signals reveals:

• Geolocation Volatility: Conflicting location data between GB/London and DE/Frankfurt am Main across different signal sources
• ASN Changes: Historical data shows ASN transitions (AS16276 OVH → AS9009 m247 ltd), indicating potential network reassignment
• Proxy Signals: Some historical observations flagged proxy/VPN characteristics (confidence 0.85)
• Risk Persistence: No persistent malicious behavior detected (threatPersistenceDays: 0)

---

NETWORK NEIGHBORHOOD

Subnet analysis for 2.58.172.0/24:

• Abuse Density: 0.6667 (moderate)
• Total Siblings: 3 active IPs in /24
• Risk Distribution: 2 low-risk neighbors identified

- 2.58.172.169 (Risk: 25)

- 2.58.172.222 (Risk: 25)

• Classification: Mostly clean subnet

---

SERVICE EXPOSURE

• Open Ports: None detected
• TLS/Certificate: No active certificates
• HTTP Services: No web services responding
• Status: Firewall-enabled, no external service exposure

---

RECOMMENDATIONS

Based on risk assessment:

1. No immediate blocking required – Risk score of 25 falls below typical threshold for automated blocking

2. Monitor for geolocation changes – Conflicting location data may indicate compromised routing or data center migration

3. Monitor ASN transitions – Historical changes suggest potential infrastructure reassignment

4. Standard logging recommended – Track for any future threat indicator emergence

---

INTELLIGENCE CONCLUSION

The IP address represents a legitimate cloud-hosting resource with minimal threat characteristics. The primary concern involves geolocation inconsistency and historical network changes rather than active malicious behavior. No immediate defensive action recommended; maintain standard logging and monitoring practices.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.