65.20.145.106📋 Copy

IP Intelligence Briefing: 65.20.145.106

Date: 2026-06-06

---

**1. Core Profile**

• Risk Score: 80/100 (High Risk)
• Ownership: Registered to ae-earthlink-dmcc-1-mnt (ARIN)
• Geolocation: UAE (Baghdad, 23.42°N, 53.85°E)
• Network Role: Web server (ports 80, 443, 22 open)
• Services: Lighttpd 1.4.39, SSH (Dropbear), no TLS certificate detected

---

**2. Threat Indicators**

• No direct malicious indicators (no malware, phishing, or spam links).
• Scanning activity observed (May–June 2026) with low confidence (0.3–0.4).
• DNS/Network: No PTR records, no email auth (SPF/DKIM), and no known abuse.

---

**3. Observation History**

• Recent activity:

- Connection failures and scanning attempts (May 29–June 6, 2026).

- Subnet classification as "clean" with no abuse density.

• Stability: Routinely unstable (route changes in last 30 days).

---

**4. Relationships & Subnet**

• Linked to: ae-earthlink-dmcc-1-mnt (same network).
• Subnet: 65.20.145.106/24 (0 active/1 total sibling IPs).
• No neighboring IPs detected in the subnet.

---

**5. Recommended Actions**

• Block the IP due to high risk score (80) and scanning activity.
• Monitor for unexpected traffic patterns or new services.
• Verify ownership with the provider (ae-earthlink-dmcc-1-mnt) to confirm legitimacy.

---

Summary:

This IP hosts a web server in the UAE with no direct malicious indicators but shows scanning activity and high risk. While no immediate compromise is confirmed, its elevated risk score and unstable routing warrant closer scrutiny. Block the IP as a precaution and validate with additional context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.