3.235.91.146📋 Copy

## IP Intelligence Briefing: 3.235.91.146

Classification: AWS EC2 Host - Low Risk Profile

Date: 2026-06-15

Prepared For: SOC Operations

---

EXECUTIVE SUMMARY

Target IP 3.235.91.146 is identified as an Amazon Web Services (AWS) EC2 compute instance in the Northern Virginia region. The IP maintains a low-risk reputation score of 25/100. Infrastructure analysis confirms operation as a Druva Inc. web service host with valid SSL/TLS certificates. No persistent malicious activity detected across observation history.

---

OWNERSHIP & INFRASTRUCTURE

DNS Resolution:

• PTR Hostname: ec2-3-235-91-146.compute-1.amazonaws.com
• Forward Resolution: Confirmed
• Hosted Domain: amazonaws.com

TLS/SSL Certificate:

• Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
• Subject: *.druva.com, druva.com
• Validation: Not self-signed, valid certificate chain

---

THREAT INDICATORS

Risk Profile:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Count: 1 (of 8 total DNSBL lists)
• Known Campaigns: None
• Is Tor Exit Node: No
• Is Known Attacker: No

Control Plane:

• BGP Prefix: 3.224.0.0/12
• Route Stability: Stable (0 changes in 30 days)
• RPKI State: Not validated
• DNSSEC Valid: Yes
• Operator Score: 0.2609 (Basic)

Threat Indicators:

• No active threat indicators present
• No known attacker signatures
• No spam source classification
• No Tor network association

---

NEIGHBORHOOD ANALYSIS

Subnet: 3.235.91.146/24

• Abuse Density: 0-1 (Minimal)
• Classification: Mostly Clean
• Active Siblings: 1
• Threat Siblings: 1
• Sibling Risk: Inherited risk score of 2

The /24 subnet maintains minimal abuse density with only one active sibling IP identified. Threat sibling presence suggests isolated incident rather than coordinated activity.

---

OBSERVATION HISTORY

Total Observations: 22 signals

Recent Activity: June 15, 2026

Key Observations:

1. DNS Configuration: SPF and DMARC records active for druva.com domain

2. Connection Status: Recent connection failures observed (2026-06-15 10:35:31 UTC)

3. Ownership Stability: No ownership changes recorded

4. Threat Persistence: No persistent malicious behavior detected

5. Signal Confidence: Variable confidence levels (0.28-0.85) across observations

---

RELATIONSHIP MAPPING

41 Relationships Identified:

• DNS Associations: Multiple EC2 hostname references
• Network Associations: AMAZON-IAD regional network
• Service Endpoints: druva.com services

---

RECOMMENDED ACTIONS

Firewall/Security Rules:

• Allow HTTPS (443) traffic as expected for web server function
• No blocking recommended based on current risk profile
• Monitor for anomalous outbound connections

SOC Monitoring Priorities:

• Watch for DNSBL listing changes
• Monitor connection failure patterns
• Track sibling IP 3.235.91.x for any activity escalation

Threat Intelligence:

• No immediate threat mitigation required
• IP maintains standard AWS infrastructure characteristics
• No indicators of compromise (IOC) present

---

CONCLUSION

IP 3.235.91.146 represents a legitimate AWS EC2 instance hosting Druva Inc. web services. The low-risk profile, clean subnet neighborhood, and absence of persistent threat indicators support continued normal operation. SOC teams may classify as benign infrastructure requiring standard monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.