3.5.130.156📋 Copy

Intelligence Briefing: IP Address 3.5.130.156/32

Overview

The IP address 3.5.130.156 was identified as a Low Risk asset with a reputation score of 25. Ownership was attributed to Amazon Data Services Northern Virginia (ASN 16509, AMAZON-S3) within the 3.5.0.0/16 CIDR block. The asset was registered under the Amazon Web Services provider with a service purpose classified as a Web Server.

Technical Profile

Reverse DNS resolution confirmed the host as s3-r-w.us-east-2.amazonaws.com within the amazonaws.com domain. Open ports identified included TCP 80 (HTTP), TCP 443 (HTTPS), and TCP 8080 (HTTP-alt). The server banner reported "AmazonS3," and TLS certification linked the address to *.s3.us-east-2.amazonaws.com.

Threat Assessment

Behavioral analysis indicated no active attacker activity, honeypot hits, or enumeration strikes. The asset was classified as a "Suspicious Host" with threat indicators present, though specific known campaigns were not matched. The control plane revealed a single DNS blacklist listing out of eight total checks. The overall risk classification remained Low Risk, but the threat actor type was flagged due to contradictory signals.

Anomalies and Validation

Geolocation data placed the host in Columbus, OH, US. However, geo-validation revealed a contradiction between the claimed geolocation and RTT physics measurements, citing a 6580.9km distance against a 45ms RTT. This signal contradiction resulted in a recommendation to Monitor the asset for changes.

Recommendation

Security operations teams are advised to Monitor the IP address. The low-risk reputation and confirmed cloud infrastructure context suggest benign traffic, but the geolocation/RTT physics violation warrants continued observation to ensure no configuration drift or misattribution occurs.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.