208.64.203.173
Intelligence Briefing: 208.64.203.173
Overview
The IP address 208.64.203.173 was identified as a Low Risk web server associated with Valve Corporation (ASN 32590). Ownership records indicated registration under the block 208.64.200.0/22. A risk score of 20 was assigned, with zero blacklist hits and no active attack indicators.
Technical Profile
The host operated HTTP and HTTPS services (ports 80 and 443) utilizing an nginx server. DNS resolution confirmed the hostname collector-02.valve.net. TLS certificate validation showed issuance by Let's Encrypt for the subject crash.steampowered.com. Email security protocols were configured with SPF and DMARC records present.
Observations and Anomalies
Activity was recorded between September 2026. While the broader subnet 208.64.203.0/24 contained one threat sibling, this specific address showed no behavioral strikes. However, geolocation data presented a contradiction: the claimed location in Washington, US, conflicted with RTT physics measurements (87.8ms average vs. 157.9ms minimum possible for the distance). Routing stability was noted as unstable over the 30-day period.
Recommendation
Due to signal contradictions regarding geolocation and routing, the asset was flagged for monitoring. No immediate firewall blocking was recommended, but traffic should be observed for behavior consistent with the neighborhood's abuse density.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Valve Corporation |
| ASN | AS32590 |
| Network Name | VALVE-V4-1 |
| CIDR Block | 208.64.200.0/22 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | collector-02.valve.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | collector-02.valve.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 4/4 domains |
| DMARC | 4/4 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 4 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | nginx |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | crash.steampowered.com |
| Valid From | 2026-08-28T05:24:56+00:00 |
| Valid Until | 2026-11-26T05:24:55+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 89 days |
| Serial Number | 060C561F065DA73A22935D6C53C951C6F2DC |
| Thumbprint | 3E16F3425B3474BCDD966FC88C5220B01247942F |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 38% | 2 | 5 |
| ownership | 27% | 2 | 4 |
| reputation | 22% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 26% | 10 | 20 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-04 17:07:06 UTC |
| Last Seen | 2026-09-20 08:31:27 UTC |
| Profile Built | 2026-09-23 00:00:09 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 38 |
Full dossier details are available via our API.