216.180.246.87📋 Copy

IP Intelligence Briefing: 216.180.246.87

Date: 2026-06-07

---

**1. Risk Profile**

• Overall Risk Score: 25 (Low Risk)
• Provider/Authority Scores: 0/0
• Stability: Unstable (route stability flag inactive)
• Threat Indicators: No direct malicious activity detected (no blacklists, spam, or known attackers).

---

**2. Ownership & Geolocation**

• ASN: 396982 (Private Customer, ARIN-regulated)
• Geolocation:

- Country: United States

- City: Massy (coordinates unconfirmed)

- Subnet: 216.180.246.0/24

• Network Role: Unknown (no CDN, cloud, or residential indicators).

---

**3. Threat Observations**

• Proxycheck.io: Marked as a compromised server (confidence: 85%) with proxy-type "Compromised Server."
• Alienvault-OTX: Detected 35 pulses linked to potential threats (confidence: 95%), though no specific campaigns or malware families are tied to this IP.
• No DNS-Based Threats: No malicious domains, email auth issues, or CAA mismatches.

---

**4. Network Relationships**

• DNS Associations:

- `crawler087.deepfield.net` (PTR record confirmed).

• Subnet Peers:

- Shared subnet `NET-216-180-246-0-24` with 13 sibling IPs (3 active, 0 malicious).

• No Known Malicious Relationships: No connections to known C2 servers, botnets, or malicious organizations.

---

**5. Neighborhood Analysis**

• Subnet Abuse Density: 0% (clean classification).
• Neighbor Risk Distribution:

- Low Risk: 9 IPs (avg. score: 25).

- Medium Risk: 7 IPs (avg. score: 50).

• Notable Neighbors:

- `216.180.246.3` (risk: 50), `216.180.246.58` (risk: 50), `216.180.246.160` (risk: 50).

---

**6. Temporal Trends**

• Observation History:

- First recorded: 2026-05-29.

- No persistent malicious behavior (threat persistence: 0 days).

- Recent changes: Proxycheck.io flagged it as a compromised server (June 7).

---

**7. Recommendations**

• Monitor Subnet: Track medium-risk neighbors for potential lateral movement.
• Investigate Proxy Flags: Confirm if compromised server status is part of a larger network compromise.
• Check DNS Activity: Monitor `crawler087.deepfield.net` for suspicious behavior (e.g., scraping, data exfiltration).
• Verify Geolocation: Confirm coordinates for Massy, as current data is unverified.

---

Conclusion: This IP is low-risk but exhibits conflicting signals (proxy compromise vs. no direct threats). Further analysis of its subnet and DNS associations is recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.