216.226.76.20

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

## IP INTELLIGENCE BRIEFING: 216.226.76.20

Classification: Moderate Risk (Score: 55/100)

Date: 2026-07-30

Analysis Status: Complete

---

EXECUTIVE SUMMARY

IP 216.226.76.20 is a single-service host within ASN 50219 (Valence Technology Co., US) exhibiting moderate risk characteristics. The address shows elevated DNSBL listings (3 of 8 total lists) and route instability, though no definitive threat indicators or known malicious campaigns were identified.

---

NETWORK ATTRIBUTION

Attribute	Value
IP Address	216.226.76.20
ASN	50219
Organization	Valence Technology Co., US
BGP Prefix	216.226.76.0/24
Country	United States (US)
Service Type	Single-Service Host
Risk Score	55/100

---

OBSERVED SERVICES & EXPOSURE

Port 22/TCP (SSH): Open with banner `SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u9`
Forward Resolution: Not confirmed
Hosted Domains: None detected
Email Authentication: No SPF/DMARC records configured

---

THREAT INTELLIGENCE

Risk Indicators:

DNSBL Listed: 3 of 8 total lists (high severity)
Route Stability: False (route changes detected in 30-day window)
Threat Indicators: None currently active
Known Campaigns: None correlated

Temporal Analysis:

Recent observation (2026-07-30) shows 8 total listings with 3 currently active
No persistent malicious behavior observed
Ownership changes: 0

---

GEOLOCATION VALIDATION

Coordinates: 37.75, -97.82
Geo-Consensus: Valid
Geo-Plausible: False (geolocation discrepancy noted)

---

NEIGHBORHOOD ANALYSIS

Subnet 216.226.76.0/24 assessment:

Abuse Density: 0
Active Siblings: 0
Threat Siblings: 0
Overall Classification: Low-risk subnet environment

---

RELATIONSHIP GRAPH

No external relationships detected (subnets, hostnames, organizations, certificates).

---

RECOMMENDED ACTIONS

Priority: HIGH

1. Monitoring: Increase logging verbosity and review recent activity from this IP due to elevated risk score (55/100)

Firewall Recommendations:

iptables: `iptables -A INPUT -s 216.226.76.20 -j DROP`
nftables: `nft add rule inet filter input ip saddr 216.226.76.20 drop`
nginx: `deny 216.226.76.20;`
pfSense: `216.226.76.20/32`
Cloudflare WAF: Block with filter `ip.src eq 216.226.76.20`
AWS WAF: Block address `216.226.76.20/32`

---

SOC ANALYST NOTES

Route instability flags warrant continued monitoring
DNSBL listings suggest potential abuse history; verify against organizational policies
SSH service exposed—assess if this is expected for legitimate operations
Consider blocking at perimeter if no legitimate business justification exists

---

Intelligence Source: IPDebrief Platform

Status: Actionable intelligence for defensive security operations

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇺🇸 United States
Region	MA
City	Boston
Timezone	—
Latitude	42.36
Longitude	-71.06

🏢 Ownership & Registration

Organization	Valence Technology Co.
ASN	AS50219
Network Name	VT-255
CIDR Block	216.226.76.0/22
RIR	ARIN
Country	United States
Abuse Contact	Available via RDAP

🌐 DNS Intelligence

PTR Record	No PTR
Forward Confirmed	No — PTR hostname does not resolve back to this IP (weak signal)

🔐 DNS Hygiene

Hygiene Score	20% (Poor)
SPF	Not configured
DMARC	Not configured
FCrDNS	Not verified
DNSSEC	Valid
CAA	Not configured

☁️ Network Classification

Infrastructure	Unknown
Service Purpose	Single-Service Host
Network Tier	Unknown — Insufficient routing data to classify

No specific classification

🔌 Services & Open Ports

Port	Service	Protocol	Banner
22	ssh	tcp	SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u9
Closed Ports	25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned)

Server	—
HTTP Title	—
SSH Version	SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u9

🔐 TLS Certificate

🔒

No certificate

Issued by —

N/A

SANs	None
Valid From	—
Valid Until	—

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	25%	1	1
routing	0%	0	0
services	25%	1	1
ownership	0%	0	0
reputation	25%	1	1
geolocation	25%	1	1
Overall	16%	4	4

Coverage: 4/6 dimensions · Data sufficiency: partial

Data Coherence	Mostly Consistent (80%) — 1 contradiction(s)
Attribution	Low (35%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement

📅 Observation Timeline 🔄 Live

First Seen	2026-07-27 21:54:25 UTC
Last Seen	2026-07-30 14:28:00 UTC
Profile Built	2026-07-30 14:37:30 UTC
Data Freshness	Live
Signal Types	20
Total Observations	20

🔍 20 signal types · 20 observations collected

This report is generated from 20+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

216.226.76.20📋 Copy