# 63.135.161.156 — IP Intelligence Summary

63.135.161.156 is an IPv4 address operated by AS206092 Internet Utilities Europe and Asia Limited (AS206092), geolocated to New York, United States. As of September 5, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/63.135.161.156
- Last updated: 2026-09-05

## Ownership

- Organization: AS206092 Internet Utilities Europe and Asia Limited
- Network name: IPXO-US-NY-NEW-YORK-CITY-63-135-161-0
- Allocated block: 63.135.161.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: ARIN

## Location

- City: New York
- Region: US-NY
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# THREAT INTELLIGENCE BRIEFING

\## Target: 63.135.161.156/32

**Classification**: Moderate Risk

**Date**: 2026-07-28

\---

\### EXECUTIVE SUMMARY

IP address 63.135.161.156 is assigned to AS206092 (Internet Utilities Europe and Asia Limited) and resides within the IPXO-US-NY-NEW-YORK-CITY-63-135-161-0 CIDR block. The IP registers a risk score of 40 (Moderate Risk) with evidence of DNSBL listings on 2 of 8 total blacklists. No active services are currently detected; the endpoint is classified as "Firewalled / No Services."

\---

\### NETWORK OWNERSHIP & GEOLOCATION

\- **ASN**: 206092

\- **Organization**: AS206092 Internet Utilities Europe and Asia Limited

\- **CIDR Block**: 63.135.161.0/24

\- **Location**: New York, NY, United States

\- **Registration**: ARIN RIR

\- **BGP Prefix**: 63.135.161.0/24 (Origin ASN: 206092)

\---

\### RISK INDICATORS

| Metric | Value |

|--------|-------|

| Risk Score | 40 / 100 |

| DNSBL Listings | 2 / 8 |

| Abuse Confidence | Null |

| Known Attacker | No |

| Spam Source | No |

| Tor Exit Node | No |

| Cloud/Proxy/VPN | No |

**Threat Indicators**: Signal history indicates 20 threat pulses detected as of 2026-07-28, though no specific campaigns or known attacker indicators are confirmed.

\---

\### NEIGHBORHOOD ANALYSIS (63.135.161.0/24)

\- **Total Siblings**: 45

\- **Abuse Density**: 0 (Minimal)

\- **Risk Distribution**: 0 High, 1 Medium, 44 Low

\- **Notable Neighbor**: 63.135.161.170 (Risk Score: 60)

The subnet demonstrates minimal abuse density with the target IP being one of 44 neighbors showing low risk scores. Authority scores remain consistent at 50 across the neighborhood.

\---

\### NETWORK ROLE & SERVICES

\- **Open Ports**: None detected

\- **TLS Certificate**: None

\- **HTTP Banner**: None

\- **Service Classification**: Firewalled / No Services

\- **DNS Records**: No PTR hostnames, no forward resolution

\---

\### OBSERVATION HISTORY (12 Signals)

Recent signals captured on 2026-07-28 confirm:

\- Geolocation consensus: United States, New York (AlienVault OTX, MaxMind GeoLite2)

\- ASN assignment: AS206092 (AlienVault OTX)

\- Operator score: Minimal (0.1304)

\- RPKI state: Not available

\- Route stability: Not stable

\---

\### RECOMMENDED ACTIONS

**Action Level**: BLOCK

The following firewall rules are recommended:

\`\`\`bash

\# iptables

iptables -A INPUT -s 63.135.161.156 -j DROP

\# nftables

nft add rule inet filter input ip saddr 63.135.161.156 drop

\# nginx

deny 63.135.161.156;

\# pfSense

63.135.161.156/32

\# Cloudflare WAF

{

"description": "Block 63.135.161.156 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 63.135.161.156"

}

}

\# AWS WAF

{

"Addresses": \["63.135.161.156/32"\],

"Description": "IPDebrief risk 40"

}

\`\`\`

\---

\### ANALYST NOTES

This endpoint demonstrates moderate risk characteristics with DNSBL presence and historical threat indicators. Despite the firewalled state and minimal subnet abuse density, the combination of blacklistings and threat signals warrants blocking. No correlated IPs or organizational relationships detected beyond the assigned network block.

**Recommendation**: Implement blocking rules on perimeter defenses and monitor for any service changes on this IP address.

## Nearby addresses

- 63.135.161.1 (https://ipdebrief.com/63.135.161.1)
- 63.135.161.5 (https://ipdebrief.com/63.135.161.5)
- 63.135.161.8 (https://ipdebrief.com/63.135.161.8)
- 63.135.161.10 (https://ipdebrief.com/63.135.161.10)
- 63.135.161.11 (https://ipdebrief.com/63.135.161.11)
- 63.135.161.14 (https://ipdebrief.com/63.135.161.14)
- 63.135.161.15 (https://ipdebrief.com/63.135.161.15)
- 63.135.161.18 (https://ipdebrief.com/63.135.161.18)
- 63.135.161.20 (https://ipdebrief.com/63.135.161.20)
- 63.135.161.21 (https://ipdebrief.com/63.135.161.21)
- 63.135.161.27 (https://ipdebrief.com/63.135.161.27)
- 63.135.161.28 (https://ipdebrief.com/63.135.161.28)

---

Source: IPDebrief, "63.135.161.156 IP intelligence", https://ipdebrief.com/63.135.161.156, updated 2026-09-05. Assessments are probabilistic.