65.20.130.220
IP Intelligence Briefing: 65.20.130.220/32
*Generated via IPDebrief Threat Intelligence Platform*
---
**1. Core Profile**
- Risk Score: 80/100 (High Risk)
- Ownership:
- ASN: AS203214
- Organization: ae-earthlink-dmcc-1-mnt (registered to HulumTele, Iraq)
- Geolocation: Baghdad, Iraq (33°N, 44°E)
- Threat Indicators:
- Listed in 4 DNSBLs (8 total lists)
- No direct malware campaigns or known attacker associations
- BGP analysis shows stable routing with minimal ASN changes
---
**2. Observation History**
- Recent Activity (30 days):
- 15 observations, with 8% of signals indicating potential threats (DNSBL, reputation feeds).
- Risk score has remained stable at 80, but DNSBL listings increased from 0 to 4 over the past month.
- No significant changes in geolocation or network infrastructure.
---
**3. Network Relationships**
- Linked Entities:
- Same network: AE-EARTHLINK-DMCC-20010129 (AS203214)
- No direct connections to known malicious subnets or organizations.
- DNSSEC validation is enabled, but no email authentication (SPF/DKIM) detected.
---
**4. Neighborhood Analysis**
- Subnet: 65.20.130.220/24
- Neighbor Risk Distribution:
- 1 high-risk IP (65.20.130.3, score 80)
- 1 medium-risk IP (65.20.130.232, score 55)
- 2 low-risk IPs (65.20.130.6, 65.20.130.33)
- Abuse Density: 25% (moderate risk within subnet).
---
**5. Recommended Actions**
- Network Segmentation: Isolate the IP from critical systems due to high risk score.
- DNSBL Monitoring: Block traffic from IPs listed in DNSBLs (e.g., Spamhaus, Barracuda).
- BGP Analysis: Verify BGP route stability and ensure no rogue route hijacks are occurring.
- Subnet Review: Investigate the high-risk neighbor (65.20.130.3) for potential lateral movement.
---
Conclusion: This IP is part of a network with mixed risk, showing signs of potential abuse (DNSBL listings) but no direct malicious activity. SOC teams should monitor traffic from this IP and its neighbors, especially given the subnet’s moderate abuse density.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | ae-earthlink-dmcc-1-mnt |
| ASN | AS203214 |
| Network Name | — |
| CIDR Block | — |
| RIR | ARIN |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | lighttpd/1.4.39 |
| HTTP Title | — |
| SSH Version | SSH-2.0-dropbear_2016.74 ,]?j????X??3@?`??curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 19% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 1 |
| geolocation | 13% | 1 | 1 |
| Overall | 16% | 8 | 9 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-21 02:17:02 UTC |
| Last Seen | 2026-06-26 14:31:57 UTC |
| Profile Built | 2026-06-25 00:48:16 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 18 |
Full dossier details are available via our API.