5.159.85.97📋 Copy

# IP Intelligence Briefing: 5.159.85.97/32

## Executive Summary

IP address 5.159.85.97 is classified as Low Risk with a risk score of 0. The address operates as a web server under the SeWiKom_GmbH network infrastructure and shows no active threat indicators.

## Network Ownership & Registration

• ASN: 209040 (terralink networks gmbh)
• Organization: MNT-TLN (SeWiKom_GmbH)
• CIDR Block: 5.159.80.0/20
• BGP Prefix: 5.159.84.0/22
• RIR: RIPE (European)
• Abuse Contact: abuse@sewikom.de

## Geolocation Data

Multiple geolocation signals indicate inconsistencies:

• Current profile: United Kingdom (London, North Rhine-Westphalia)
• Historical signals: Germany (Beverungen, DE)
• Geo Consensus: False (3 sources, no agreement)
• Geographically Plausible: False

## Threat Assessment

• Risk Score: 0
• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None detected
• Abuse Confidence Score: Not available

## Service Analysis

• Primary Service: Web Server (HTTPS/443)
• TLS Certificate: Self-signed (CN=5.159.85.97)
• Associated Domains: fritz.box, www.fritz.box, fritzbox.internal, fritzbox.home.arpa, myfritz.box
• HTTP Version: 1.1
• Server Status Code: 200

## DNS Configuration

• PTR Hostnames: None
• Forward Resolution: Not confirmed
• Email Authentication: SPF and DMARC not configured
• Hosted Domain Count: 0

## Neighborhood Analysis

• Subnet: 5.159.85.0/24
• Abuse Density: 0 (Clean)
• Active Siblings: 1
• Threat Siblings: 0
• Classification: Clean

## Historical Observations (16 signals)

Recent observations show:

• ASN 59507 (terralink networks gmbh) flagged with threat indicators on 2026-07-29
• Geographic signals oscillated between DE and GB
• One observation noted threat presence with pulse count of 1

## Control Plane Analysis

• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable
• Route Changes (30d): 0
• MoAS: False
• DNSBL Listed: 0/8 lists

## Relationship Graph

• Linked Entity: SeWiKom_GmbH (Same Network)
• No additional relationships detected (certificates, organizations, subnets)

## Security Actions

No specific firewall rules or security actions recommended based on current risk profile. The IP demonstrates minimal malicious activity.

## SOC Analyst Recommendations

1. Monitor Geographic Inconsistencies: The conflicting location data (GB vs DE) warrants periodic revalidation

2. Review TLS Certificates: Self-signed certificate on fritz.box domain may indicate internal infrastructure

3. Track Historical Threat Signals: Previous threat feed association with ASN 59507 should be monitored for recurrence

4. Verify Email Authentication: Absence of SPF/DMARC records could indicate misconfiguration

5. Assess Network Stability: Route instability flag suggests monitoring BGP announcements

## Conclusion

5.159.85.97 represents low-risk infrastructure operating as a web server under SeWiKom_GmbH. While no active threats are present, the geographic data inconsistency and historical threat associations warrant continued monitoring. No immediate blocking or mitigation actions required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.