47.250.159.164📋 Copy

IP Intelligence Briefing: 47.250.159.164

Date: 2026-06-18

---

**1. Core Profile**

• Risk Score: Low (25/100) | Provider Score: 0 | Authority Score: 0
• Ownership:

- ASN: 45102 | Organization: Alibaba Cloud LLC

- Geolocation: Listed as "US" (country code) but associated with Kuala Lumpur, Malaysia (city field).

• Network Role:

- Cloud Compute Host | Hosting Provider: Alibaba Cloud

- Services: Open SSH (port 22, version `SSH-2.0-OpenSSH_9.6p1`).

• Threat Indicators:

- No active threats, malware, or known attacker associations.

- Single high-severity listing (1/8 threat feeds) observed on 2026-06-18.

---

**2. Observation History**

• Latest Activity:

- June 18, 2026: High-severity signal detected (likely false positive, as no further details).

- June 3, 2026: Scanned for open ports (SSH active), no TLS/http activity.

• Stability:

- BGP route instability detected (routeChanges30d = 0, isRouteStable = false).

- No persistent malicious activity.

---

**3. Relationships & Network Context**

• Linked Entities:

- Same Network: Repeatedly linked to "AL-3" (likely a network identifier).

- Subnet: 47.250.159.164/24 | Abuse Density: 0% (clean subnet).

• Neighbors:

- No neighboring IPs detected (subtree may be underutilized or isolated).

---

**4. Geolocation & DNS**

• Geolocation Discrepancy:

- Country code "US" but city field lists "Kuala Lumpur" (Malaysia). Possible misattribution.

• DNS:

- No PTR records or domain associations.

- Email Reputation: No SPF/DKIM records detected.

---

**5. Recommendations**

• Monitor SSH Activity: Track access to port 22, as it is open and unencrypted.
• Investigate Geolocation Anomaly: Verify if the "US" country code is accurate or a false positive.
• Check Route Stability: Monitor BGP updates for 47.250.128.0/18 prefix (associated with Alibaba Cloud).
• Validate Threat Listing: Cross-check the single high-severity signal with upstream feeds for context.

---

Conclusion:

This IP is low risk but exhibits conflicting geolocation data and a single high-severity signal. While it appears to be a legitimate Alibaba Cloud host, further investigation is recommended to resolve the geolocation discrepancy and validate the threat listing. No immediate mitigation is required, but ongoing monitoring of SSH activity and network stability is advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.