47.253.224.181

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

## IP Intelligence Briefing: 47.253.224.181/32

Classification: Moderate Risk Cloud Infrastructure

Report Date: 2026-07-30

---

Executive Summary

IP 47.253.224.181 is a cloud compute endpoint hosted within Alibaba Cloud US infrastructure (ASN 45102). The address carries a moderate risk score of 50/100 with no active threat indicators currently observed. The IP operates in a cloud hosting environment with firewalled services and no open ports detected.

---

Ownership and Geolocation

Organization: ALIBABA CLOUD - US (Alibaba Cloud US)
ASN: 45102
CIDR Block: 47.253.0.0/16
Country: US
Infrastructure Type: CloudCompute
Classification: Cloud Hosting

---

Risk Profile

Metric	Value
Risk Score	50 (Moderate)
Provider Score	0
Authority Score	0
Blacklist Count	0
DNSBL Listings	2 of 8 lists
Tor Exit Node	No
Known Attacker	No
Spam Source	No

---

Network Activity and Services

Open Ports: None detected
Service Status: Firewalled / No Services
DNS Records: No PTR hostnames; no forward resolution
TLS/HTTP: No certificates, banners, or HTTP titles identified

---

Neighborhood Analysis (Subnet: 47.253.224.0/24)

Abuse Density: 0 (Clean)
Total Siblings: 2
Active Siblings: 0
Threat Siblings: 0
Neighbor Risk: 47.253.224.222 carries risk score 25

The surrounding subnet shows no abuse activity or correlated threats.

---

Historical Observations

Total Signals: 13 observations
Recent Activity: Signals observed on 2026-07-30
Threat Persistence: None detected
Ownership Stability: Stable (0 ownership changes)
Persistence Flag: Not persistently malicious

---

Control Plane Intelligence

BGP Prefix: 47.253.128.0/17
Route Stability: Not stable
RPKI State: Not validated
DNSSEC: Valid
Geolocation Validation: Distance 6328 km; RTT violation detected (31ms observed vs 126.6ms minimum possible)

---

Recommended Security Actions

Firewall Blocking Rules (Recommended):

```bash

# iptables

iptables -A INPUT -s 47.253.224.181 -j DROP

# nftables

nft add rule inet filter input ip saddr 47.253.224.181 drop

# Cloudflare WAF

Action: Block

Expression: ip.src eq 47.253.224.181

# AWS WAF

Addresses: 47.253.224.181/32

Description: IPDebrief risk 50

```

Assessment: While the IP carries a moderate risk score, current threat indicators are absent. The moderate classification combined with the moderate risk score warrants consideration for blocking depending on threat posture, though the IP shows no active malicious behavior or known campaign associations.

---

Analyst Notes

This IP represents standard cloud infrastructure with no immediate threat indicators. The moderate risk score appears to reflect the hosting nature of the address rather than active malicious activity. Monitoring recommended for any changes in service patterns or threat signal emergence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country	🇺🇸 United States
Region	Virginia
City	—
Timezone	—
Latitude	38.69
Longitude	-77.30

🏢 Ownership & Registration

Organization	Alibaba Cloud - US
ASN	AS45102
Network Name	ALIBABA CLOUD - US
CIDR Block	47.253.0.0/16
RIR	ARIN
Country	United States
Abuse Contact	—

🌐 DNS Intelligence

PTR Record	No PTR
Forward Confirmed	No — PTR hostname does not resolve back to this IP (weak signal)

🔐 DNS Hygiene

Hygiene Score	20% (Poor)
SPF	Not configured
DMARC	Not configured
FCrDNS	Not verified
DNSSEC	Valid
CAA	Not configured

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Web Server
Network Tier	Hosting — Infrastructure provider without advanced routing

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
80	http	tcp	—
443	https	tcp	—
22	ssh	tcp	SSH-2.0-OpenSSH_7.4
Closed Ports	25, 3389, 8080, 8443 (3 open / 7 scanned)

Server	Apache
HTTP Title	—
SSH Version	SSH-2.0-OpenSSH_7.4

🔐 TLS Certificate

A self-signed certificate was detected. This is common for development servers, internal services, or IoT devices.

⚠️

E=ssl@iz0xi7y3reeva700qi08t6z, CN=iz0xi7y3reeva700qi08t6z

Issued by E=ssl@iz0xi7y3reeva700qi08t6z, CN=iz0xi7y3reeva700qi08t6z

Self-signed: Yes

SANs	iz0xi7y3reeva700qi08t6z
Valid From	2026-05-20T05:17:35+00:00
Valid Until	2027-05-20T05:17:35+00:00
TLS Protocol	Tls12
Cipher Suite	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Signature Algorithm	sha256RSA
Validity Period	365 days
Serial Number	00C114F569
Thumbprint	FF28CB4CE0B2E736AD879AD120604D5E4960FAF9

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	25%	1	1
routing	25%	1	1
services	25%	1	1
ownership	25%	1	1
reputation	0%	0	0
geolocation	35%	2	2
Overall	22%	6	6

Coverage: 5/6 dimensions · Data sufficiency: partial

Data Coherence	Mostly Consistent (80%) — 1 contradiction(s)
Attribution	Low (35%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement

📅 Observation Timeline 🔄 Live

First Seen	2026-07-29 16:42:15 UTC
Last Seen	2026-08-04 05:43:03 UTC
Profile Built	2026-08-02 23:19:50 UTC
Data Freshness	Live
Signal Types	16
Total Observations	16

🔍 16 signal types · 16 observations collected

This report is generated from 16+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

47.253.224.181📋 Copy