51.158.152.22📋 Copy

# IP INTELLIGENCE BRIEFING: 51.158.152.22/32

## Executive Summary

The target IP 51.158.152.22 is a Scaleway cloud infrastructure asset located in Haarlem, Netherlands. The IP carries a moderate risk score of 50, primarily due to DNSBL listings. The subnet shows no abuse activity, and the host operates standard web services with proper security headers configured.

## Technical Profile

Ownership & Infrastructure

• ASN: 12876 (Scaleway)
• Organization: SCALEWAY-AMS
• CIDR Block: 51.158.128.0/17
• Infrastructure Type: Cloud Compute
• Location: Haarlem, North Holland, Netherlands (49.38°N, 3.85°E)

Network Services

• Port 80: HTTP (nginx/1.18.0 Ubuntu)
• Port 443: HTTPS (TLS v1.3, Let's Encrypt certificate)
• Port 22: SSH (OpenSSH 8.9p1)
• Port 8080: HTTP-Alt

DNS & Email Security

• PTR Record: 51-158-152-22.rev.poneytelecom.eu
• SPF: Configured (v=spf1 include:_spf.protonmail.ch mx -all)
• DMARC: p=reject policy enforced
• TLS Certificate: CN=51.158.152.22.sslip.io (Let's Encrypt)

## Risk Assessment

Current Risk Score: 50/100 (Moderate Risk)

Threat Indicators:

• DNSBL Status: Listed on 2 of 8 total blacklist feeds
• Abuse Confidence Score: Not specified
• Known Attacks/Scans: No active threat indicators detected
• Campaign Association: None identified

Control Plane Data:

• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not validated
• MOAS Detection: Not flagged
• Operator Score: 0.2609 (Basic)

## Historical Analysis

The IP has generated 24 signal observations. Recent activity indicates:

• Persistent provider classification (Scaleway)
• HTTP service fingerprinting shows nginx serving content with 404 responses
• DNS resolution alternates between poneytelecom.eu and sslip.io domains
• Blacklist presence observed with high-severity listings on 2 of 8 feeds
• No observed threat persistence patterns

## Neighborhood Analysis

Subnet: 51.158.152.22/24

• Classification: Clean
• Abuse Density: 0%
• High-Risk IPs: 0
• Medium-Risk IPs: 0
• Low-Risk IPs: 0
• Total Siblings: 1

The immediate /24 subnet shows no abuse activity, indicating the risk is isolated to this specific host.

## Relationship Graph

The IP maintains associations with:

• DNS Hostnames: 51-158-152-22.rev.poneytelecom.eu
• Network: SCALEWAY-AMS (multiple associations)

No malicious or suspicious relationships were identified.

## Recommendations

SOC Analyst Actions:

1. Monitor: Track DNSBL status changes - current listings may warrant investigation if associated with the IP's operational purpose

2. Verify Legitimacy: The sslip.io certificate and protonmail SPF records suggest legitimate email/web hosting use cases

3. Baseline: Establish traffic patterns to distinguish legitimate activity from potential misuse

4. Block Decision: Risk score of 50 with no active attack indicators suggests monitoring rather than blocking

Firewall Considerations:

• No specific blocking rules recommended given the lack of active threat indicators
• SSH port 22 exposure on cloud infrastructure is common but should be monitored for brute force attempts
• Web services on ports 80/443/8080 are standard for cloud hosting

## Conclusion

IP 51.158.152.22 represents a legitimate Scaleway cloud host with moderate risk primarily due to DNSBL presence. The subnet is clean, no active threats are detected, and the host maintains proper email security configurations. Recommend continued monitoring rather than immediate blocking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.