65.49.1.108📋 Copy

IP INTELLIGENCE BRIEFING: 65.49.1.108/32

Executive Summary

IP address 65.49.1.108 is identified as a high-risk (80/100) endpoint belonging to The Shadowserver Foundation, Inc. (ASN 6939). The IP resolves to scan-59a.shadowserver.org and operates a lighttpd/1.4.74 web service on port 80. Intelligence indicates this is a honeypot/monitoring infrastructure component rather than a traditional malicious threat source.

Ownership & Infrastructure

• Organization: The Shadowserver Foundation, Inc.
• ASN: 6939 (Hurricane Electric)
• Location: Boston, MA, US
• Network Block: 65.49.0.0/17
• Service Role: Single-Service Host
• DNS Resolution: scan-59a.shadowserver.org / 108.0-24.1.49.65.in-addr.arpa

Risk Assessment

• Risk Score: 80/100 (High Risk)
• Abuse Confidence: Elevated (consistent with honeypot monitoring infrastructure)
• Control Plane: 4 DNSBL listings out of 8 total lists; route stability flagged as false
• Threat Indicators: None detected; no known campaigns or attacker signatures

Service Fingerprint

• Open Port: 80/TCP (HTTP)
• Server Banner: lighttpd/1.4.74
• HTTP Status: 200 OK
• Security Headers: No HSTS, CSP, or referrer policy headers present

Neighborhood Analysis (65.49.1.0/24)

• Subnet Classification: Mixed (abuse density: 26.47%)
• Total Neighbors: 39
• Risk Distribution: 0 high-risk, 12 medium-risk, 27 low-risk
• Notable Neighbors: 65.49.1.38 (70), 65.49.1.94 (55), 65.49.1.132 (55), 65.49.1.192 (55), 65.49.1.202 (55)

Temporal History

Observations from June 2026 show consistent lighttpd service operation and stable subnet classification. No significant behavioral changes observed over the monitoring period.

Intelligence Interpretation

This IP represents Shadowserver Foundation honeypot infrastructure designed to detect and monitor malicious activity. The elevated risk score reflects its operational purpose rather than inherent malicious intent. However, traffic to/from this IP should be monitored as it actively probes network endpoints.

Recommended Actions

• Immediate: Block at perimeter firewall (iptables/nftables rules provided)
• Monitoring: Increase logging verbosity and review all activity from this IP
• Context: Shadowserver Foundation operates legitimate monitoring infrastructure; consider whitelist evaluation if traffic patterns indicate benign scanning/research activities

Technical Recommendations by Platform

```

iptables: iptables -A INPUT -s 65.49.1.108 -j DROP

nftables: nft add rule inet filter input ip saddr 65.49.1.108 drop

nginx: deny 65.49.1.108;

Cloudflare WAF: Block with expression ip.src eq 65.49.1.108

AWS WAF: Add 65.49.1.108/32 to block list

```

Assessment Confidence: High. Multiple data sources (DNS, ASN, service fingerprint, historical patterns) consistently identify this as Shadowserver Foundation monitoring infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.