2a01:f2c0:390d:ab75:ee24:a03d:539b:a979
## IP Intelligence Briefing: 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979
Classification: Low Risk / Legitimate Infrastructure
Date: November 3, 2026
Analyst: IPDebrief Intelligence Platform
Executive Summary
The IP address 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 presents as low-risk infrastructure with no active threat indicators. The address is assigned to Zenlayer Inc. (AS62610) and is classified as "Private" network. No services are currently active, and the IP has not been associated with malicious activity or security incidents.
Risk Assessment
- Overall Risk Score: 0 (Low Risk)
- Abuse Confidence: Not applicable (no abuse signals)
- Blacklist Status: Clean (0 blacklist entries)
- Campaign Association: None detected
- Threat Actor Attribution: Not associated with any known threat actor
Network Ownership and Assignment
- ASN: 62610 (ZEN-DPS - Zenlayer Inc, US)
- Organization: lir-lt-mbeisina-1-MNT
- RIR Registration: ARIN
- Network Type: Private
- BGP Prefix: 2a01:f2c0::/29
- Origin Point: Lithuania (LT), as per RIPE routing data
Geolocation Data
Geolocation signals show inconsistencies requiring validation:
- Primary Signal: United States, New York (MaxMind GeoLite2)
- Secondary Signal: Lithuania, Vilnius (RDAP registration)
- Consensus: GeoPlausible = true, but distance variance of 5,968.4 km noted
- Validation Status: ICMP validation blocked; unable to confirm true location
Network Behavior and Services
- Open Ports: None detected
- Service Status: Firewalled / No Services
- TLS Certificates: None
- HTTP Banner: None
- DNS PTR Record: Not configured
Threat Indicators
- Tor Exit Node: No
- Known Attacker: No
- Spam Source: No
- Vulnerability Scans: None detected
- WAF Violations: 0
- Honeypot Hits: 0
Neighborhood Analysis
The /48 subnet (2a01:f2c0:390d:ab75:ee24:a03d:539b:a979/48) contains:
- Total Siblings: 1 active
- Threat Siblings: 1
- Abuse Density: Low (score: 1, classification: "mostly_clean")
- Inherited Risk: 2
Historical Observations
- Total Observations: 17 signals
- First Seen: November 3, 2026 (recent)
- Threat Persistence: 0 days (not persistently malicious)
- Observation Trend: Signals indicate stable, benign behavior with no escalation
Recommended Actions
Status: ALLOW
Severity: Informational
No firewall rules or blocking actions recommended. The IP address shows no significant risk indicators and is classified as legitimate infrastructure. Standard traffic inspection and logging are sufficient.
Intelligence Notes
The IP address demonstrates characteristics consistent with enterprise or service provider infrastructure. The lack of open ports and firewall status aligns with secure deployment practices. The geolocation discrepancy between routing registry data (Lithuania) and geolocation databases (US) warrants monitoring but does not indicate malicious activity. No immediate defensive actions are required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | lir-lt-mbeisina-1-MNT |
| ASN | AS62610 |
| Network Name | Private |
| CIDR Block | — |
| RIR | ARIN |
| Country | US |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 0% (None) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS62610 |
| Network Prefix | 2a01:f2c0::/29 |
| Route mapping | Found |
| Certificates in transparency logs | 0 certificates |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 35% | 2 | 2 |
| ownership | 25% | 1 | 2 |
| reputation | 25% | 1 | 1 |
| geolocation | 25% | 1 | 1 |
| Overall | 26% | 7 | 8 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-11-03 06:37:31 UTC |
| Last Seen | 2026-11-03 06:37:31 UTC |
| Profile Built | 2026-11-03 06:52:08 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 20 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979
Who owns the IP address 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979?
2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 is registered to lir-lt-mbeisina-1-MNT. Registration is held at ARIN.
Where is 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 located?
Geolocation data places 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 in New York, New York, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 malicious or safe?
2a01:f2c0:390d:ab75:ee24:a03d:539b:a979 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.