54.159.103.143📋 Copy

# IP Intelligence Briefing: 54.159.103.143/32

Date: 2026-08-06

Classification: Moderate Risk (Score: 50)

---

## Executive Summary

IP 54.159.103.143 is a Microsoft IIS-based web server hosted on Amazon Web Services infrastructure in Ashburn, Virginia. The IP demonstrates moderate risk characteristics with a risk score of 50. The address resolves to a legitimate AWS EC2 instance associated with the domain hawksearch.com.

---

## Infrastructure Profile

Ownership: Amazon Technologies Inc. (AS14618)

Network: AMAZON, CIDR Block: 54.144.0.0/12

Geolocation: United States, Virginia, Ashburn

Cloud Provider: Amazon Web Services

DNS Resolution: ec2-54-159-103-143.compute-1.amazonaws.com

Forward Confirmed: Yes

PTR Record: ec2-54-159-103-143.compute-1.amazonaws.com

---

## Service Analysis

Open Ports: TCP/80 (HTTP), TCP/443 (HTTPS)

Server Banner: Microsoft-IIS/10.0

TLS Certificate:

• Issuer: CN=Amazon RSA 2048 M04, O=Amazon, C=US
• Subject: CN=hawksearch.com, SANs: hawksearch.com, *.hawksearch.com
• Self-Signed: No

Security Headers:

• HSTS: Enabled (max-age=31536000; includeSubDomains; preload)
• HTTP/2: Supported
• CSP: Not present

---

## Threat Indicators

Risk Classification: Moderate Risk

Abuse Confidence Score: Not applicable

Known Attacker: No

Tor Exit Node: No

Spam Source: No

DNSBL Listings: 2 out of 8 lists

Campaign Indicators:

• Campaign Likelihood: None
• Threat Observation Count: 1
• Persistently Malicious: No

---

## Neighborhood Assessment

Subnet: 54.159.103.143/24

Abuse Density: 0 (Low)

Classification: Mostly Clean

Threat Siblings: 1

Active Siblings: 1

The /24 subnet exhibits minimal abuse activity with a single threat sibling identified.

---

## Observations History

Total Observations: 23

Recent Activity: 2026-08-06

Key Signals:

• Status Code: 403 (Forbidden) observed during recent scans
• Server Response Time: ~142ms TTFB
• TLS Protocol: TLS 1.2 (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
• HSTS: Preload list enabled
• Server Fingerprint: Microsoft-IIS/10.0, powered by ASP.NET

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False

---

## Control Plane Data

Origin ASN: 14618

BGP Prefix: 54.156.0.0/14

Operator Score: 0.2609 (Basic)

Route Changes (30d): 0

Route Stable: No

DNSSEC Valid: Yes

---

## Intelligence Assessment

The IP address 54.159.103.143 operates as a standard AWS-hosted web server with legitimate infrastructure indicators. The moderate risk score (50) reflects standard hosting infrastructure activity rather than malicious behavior. The associated domain hawksearch.com indicates this may be a search-related service. The presence of 403 responses suggests normal access control enforcement. The IP maintains valid security headers including HSTS and operates on proper TLS protocols.

Recommended Actions: No immediate blocking recommended. Continue standard monitoring. The IP does not exhibit characteristics of known malicious infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.