63.135.161.156📋 Copy

# THREAT INTELLIGENCE BRIEFING

## Target: 63.135.161.156/32

Classification: Moderate Risk

Date: 2026-07-28

---

EXECUTIVE SUMMARY

IP address 63.135.161.156 is assigned to AS206092 (Internet Utilities Europe and Asia Limited) and resides within the IPXO-US-NY-NEW-YORK-CITY-63-135-161-0 CIDR block. The IP registers a risk score of 40 (Moderate Risk) with evidence of DNSBL listings on 2 of 8 total blacklists. No active services are currently detected; the endpoint is classified as "Firewalled / No Services."

---

NETWORK OWNERSHIP & GEOLOCATION

• ASN: 206092
• Organization: AS206092 Internet Utilities Europe and Asia Limited
• CIDR Block: 63.135.161.0/24
• Location: New York, NY, United States
• Registration: ARIN RIR
• BGP Prefix: 63.135.161.0/24 (Origin ASN: 206092)

---

RISK INDICATORS

Threat Indicators: Signal history indicates 20 threat pulses detected as of 2026-07-28, though no specific campaigns or known attacker indicators are confirmed.

---

NEIGHBORHOOD ANALYSIS (63.135.161.0/24)

• Total Siblings: 45
• Abuse Density: 0 (Minimal)
• Risk Distribution: 0 High, 1 Medium, 44 Low
• Notable Neighbor: 63.135.161.170 (Risk Score: 60)

The subnet demonstrates minimal abuse density with the target IP being one of 44 neighbors showing low risk scores. Authority scores remain consistent at 50 across the neighborhood.

---

NETWORK ROLE & SERVICES

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Service Classification: Firewalled / No Services
• DNS Records: No PTR hostnames, no forward resolution

---

OBSERVATION HISTORY (12 Signals)

Recent signals captured on 2026-07-28 confirm:

• Geolocation consensus: United States, New York (AlienVault OTX, MaxMind GeoLite2)
• ASN assignment: AS206092 (AlienVault OTX)
• Operator score: Minimal (0.1304)
• RPKI state: Not available
• Route stability: Not stable

---

RECOMMENDED ACTIONS

Action Level: BLOCK

The following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 63.135.161.156 -j DROP

# nftables

nft add rule inet filter input ip saddr 63.135.161.156 drop

# nginx

deny 63.135.161.156;

# pfSense

63.135.161.156/32

# Cloudflare WAF

{

"description": "Block 63.135.161.156 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 63.135.161.156"

}

}

# AWS WAF

{

"Addresses": ["63.135.161.156/32"],

"Description": "IPDebrief risk 40"

}

```

---

ANALYST NOTES

This endpoint demonstrates moderate risk characteristics with DNSBL presence and historical threat indicators. Despite the firewalled state and minimal subnet abuse density, the combination of blacklistings and threat signals warrants blocking. No correlated IPs or organizational relationships detected beyond the assigned network block.

Recommendation: Implement blocking rules on perimeter defenses and monitor for any service changes on this IP address.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.