IPDebrief

5.230.219.100

IP Intelligence Dossier
Your IP: 216.73.217.131
{ } JSON 🔧 Full Actions API
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

Intelligence Briefing: 5.230.219.100/32

Overview

The target IP was assigned a High Risk reputation rating with a risk score of 70. It was registered within the GHOSTNET-MNT organization under the DE-GHOSTNET-FRA-GN-HOSTING-VPS network block (5.230.219.0/24) in Frankfurt, Germany.

Threat Profile

Analysis indicated the IP functioned as a Tor exit node, with specific Tor exit indicators observed. One blacklist entry was recorded. No known campaigns were associated with this address.

Network Services

Open ports included TCP/80 (HTTP), TCP/443 (HTTPS), and TCP/22 (SSH). The SSH service identified as OpenSSH_10.0p2 Debian-7+deb13u4. TLS certificate analysis revealed an issuer of CN=www.bh73pawjovv.com.

Network Resolution

DNS records linked the IP to ghostgate.de with reverse resolution pointing to placeholder.ghostgate.de. Forward confirmation was not verified.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

Country🇩🇪 Germany
Region—
CityFrankfurt
TimezoneEurope/Berlin
Latitude—
Longitude—

🏢 Ownership & Registration

OrganizationGHOSTNET-MNT
ASNAS12586
Network NameDE-GHOSTNET-FRA-GN-HOSTING-VPS
CIDR Block5.230.219.0/24
RIRRIPE
CountryDE
Abuse ContactAvailable via RDAP

🌐 DNS Intelligence

PTRplaceholder.ghostgate.de
Forward ConfirmedNo — PTR hostname does not resolve back to this IP (weak signal)
Forward Hostnamesplaceholder.ghostgate.de

🔐 DNS Hygiene

Hygiene Score0% (None)
SPFNot configured
DMARCNot configured
FCrDNSNot verified
DNSSECNot signed
CAANot configured

☁️ Network Classification

InfrastructureUnknown
Service PurposeWeb Server
Network TierUnknown — Insufficient routing data to classify
No specific classification

🔌 Services & Open Ports

PortServiceProtocolBanner
80httptcp—
443httpstcp—
22sshtcp
Closed Ports25, 3389, 8080, 8443 (3 open / 7 scanned)
Server—
HTTP Title—
SSH VersionSSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4

🔐 TLS Certificate

🔒
CN=www.bexdunta7m36qxzs3.net
Issued by CN=www.bh73pawjovv.com
Self-signed: No
SANsNone
Valid From2026-04-05T00:00:00+00:00
Valid Until2026-10-13T23:59:59+00:00
TLS ProtocolTls13
Cipher SuiteTLS_AES_256_GCM_SHA384
Signature Algorithmsha256RSA
Validity Period144 days
Serial Number00C4C7D47E89AA5A58
Thumbprint34829029D7B3B4DD9F4C7FE4818B77E20F6649C3

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

DimensionScoreSourcesObservations
threat
42%
26
routing
38%
23
services
45%
27
ownership
47%
36
reputation
45%
118
geolocation
24%
22
Overall40%1242
Coverage: 6/6 dimensions · Data sufficiency: sufficient
Data CoherenceConsistent (100%)
AttributionModerate (50%)
OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

📅 Observation Timeline 🔄 Live

First Seen2026-08-21 05:02:49 UTC
Last Seen2026-09-04 06:56:09 UTC
Profile Built2026-09-04 06:44:26 UTC
Data FreshnessLive
Signal Types27
Total Observations67
🔍 27 signal types · 67 observations collected
This report is generated from 27+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.
{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.