65.20.237.119📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 65.20.237.119/32

Classification: High Risk Threat Actor

Date: 2026-06-25

## EXECUTIVE SUMMARY

IP 65.20.237.119 is classified as a high-risk threat actor with a risk score of 80/100. The address operates as a compromised web server infrastructure with multiple threat indicators, DNSBL listings, and high-abuse neighborhood context. Immediate defensive measures are recommended.

## THREAT PROFILE

• Risk Score: 80/100 (High Risk)
• Reputation: High Risk
• Abuse Confidence: Elevated based on subnet abuse density (0.667)
• Service Role: Web Server (HTTP/HTTPS/SSH)
• Server Fingerprint: lighttpd/1.4.39, SSH-2.0-dropbear_2016.74

## GEOLOCATION ANALYSIS

• Reported Country: AE (UAE) / IQ (Iraq) — Geolocation inconsistencies detected
• ASN: 203214 (ae-earthlink-dmcc-1-mnt)
• BGP Prefix: 65.20.237.0/24
• Route Stability: Unstable (isRouteStable: false)
• RIR: ARIN

## THREAT INDICATORS

• DNSBL Listings: 4 of 8 total lists (45% listing rate)
• Threat Pulses: 50+ historical detections
• Geolocation Anomalies: Mixed country reports (AE/IQ) suggest infrastructure reuse or spoofing
• SSH Banner: dropbear_2016.74 — Outdated, vulnerable SSH implementation
• Threat Persistence: Active threat observation count indicates ongoing malicious activity

## NEIGHBORHOOD ANALYSIS

• Subnet: 65.20.237.0/24
• Abuse Density: 0.667 (High Abuse Classification)
• Total Siblings: 6
• Threat Siblings: 4 of 6
• High-Risk Neighbors Identified:

- 65.20.237.109 (Risk: 80)

- 65.20.237.175 (Risk: 80)

- 65.20.237.191 (Risk: 80)

- 65.20.237.40 (Risk: 55)

## NETWORK RELATIONSHIPS

• All relationships trace to network AE-EARTHLINK-DMCC-20010129
• No distinct organizational relationships detected
• Infrastructure appears part of compromised hosting cluster

## OBSERVATION HISTORY

• Total Signals: 16 observations
• Recent Activity: Threat signals detected as recently as 2026-06-25
• Abuse Classification: High abuse classification noted since 2026-06-09
• Geolocation Shifts: Historical data shows country transitions between AE and IQ

## RECOMMENDED ACTIONS

## FIREWALL RULES

```bash

# iptables

iptables -A INPUT -s 65.20.237.119 -j DROP

# nftables

nft add rule inet filter input ip saddr 65.20.237.119 drop

# nginx

deny 65.20.237.119;

```

Note: This IP should be blocked at perimeter firewall and WAF. Correlate with internal logs for any recent activity. The subnet 65.20.237.0/24 warrants broader investigation given the 0.667 abuse density.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.