# 3.5.104.173 — IP Intelligence Summary

3.5.104.173 is an IPv4 address operated by Amazon Data Services Northern Virginia (AS16509), geolocated to Columbus, United States. It belongs to datacenter or hosting infrastructure. As of November 2, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/3.5.104.173
- Last updated: 2026-11-02

## Ownership

- Organization: Amazon Data Services Northern Virginia
- Network name: AMAZON-S3
- Allocated block: 3.5.0.0/16
- ASN: AS16509 (https://ipdebrief.com/asn/16509)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Columbus
- Region: OH
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: CloudCompute
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 80/tcp — http
- 443/tcp — https
- 8080/tcp — http-alt

## Analyst narrative

Intelligence analysis identified IP 3.5.104.173 as a low-risk host with a risk score of 25. Ownership records attributed the address to Amazon Data Services Northern Virginia (ASN 16509) within the AMAZON-S3 CIDR block (3.5.0.0/16).

Service scanning indicated the IP operated as a cloud compute host providing web services on ports 80, 443, and 8080. TLS certificate validation linked the address to Amazon S3 domains in us-east-2, with a server banner identifying the service as AmazonS3.

Geolocation data placed the infrastructure in Columbus, Ohio. However, network validation metrics contradicted this placement; RTT measurements recorded 35ms against a calculated physical distance of 6580.9km, resulting in a physics violation. This inconsistency contributed to a "Suspicious Host" classification despite the absence of active threat indicators or known campaigns.

No malicious indicators were found on threat feeds, and the address was not listed as a known attacker or Tor exit node. Behavioral analysis recorded zero incidents, enumeration strikes, or WAF violations. The immediate subnet (3.5.104.0/24) exhibited mixed classification with an abuse density of 0.4.

Recommendations advised analysts to monitor the address due to signal contradictions between geolocation and network physics.

## Nearby addresses

- 3.5.104.20 (https://ipdebrief.com/3.5.104.20)
- 3.5.104.41 (https://ipdebrief.com/3.5.104.41)
- 3.5.104.53 (https://ipdebrief.com/3.5.104.53)
- 3.5.104.55 (https://ipdebrief.com/3.5.104.55)
- 3.5.104.105 (https://ipdebrief.com/3.5.104.105)
- 3.5.104.154 (https://ipdebrief.com/3.5.104.154)
- 3.5.104.160 (https://ipdebrief.com/3.5.104.160)
- 3.5.104.196 (https://ipdebrief.com/3.5.104.196)
- 3.5.104.251 (https://ipdebrief.com/3.5.104.251)

---

Source: IPDebrief, "3.5.104.173 IP intelligence", https://ipdebrief.com/3.5.104.173, updated 2026-11-02. Assessments are probabilistic.