66.132.172.128📋 Copy

IP Intelligence Briefing: 66.132.172.128/32

Date: 2026-06-06

---

**1. Core Profile**

• Risk Score: 25 (Low Risk)
• Ownership:

- ASN: 398324

- Organization: Censys, Inc. (RID: ARIN)

- Subnet: 66.132.172.0/24

• Geolocation:

- Country: United States (US)

- Region: Michigan (MI)

- City: Ann Arbor (Old West Side)

- Geo-Plausibility: False (RTT anomalies detected)

• Threat Indicators:

- No malicious indicators, abuse confidence, or blacklist entries.

- Not a Tor exit node, spam source, or known attacker.

---

**2. Network Behavior**

• Services:

- No open ports, TLS certificates, or HTTP services detected.

• DNS Associations:

- Linked to censys-scanner.com (PTR: `128.172.132.66.censys-scanner.com`).

- No email authentication records (SPF/DKIM).

• Control Plane:

- BGP prefix: `66.132.172.0/24`

- Route stability: Unstable (route changes in 30 days).

- DNSSEC valid, but DNSBL listed in 1/8 public lists.

---

**3. Observation History**

• Recent Activity (Last 30 Days):

- DNS Resolution: Consistent with `censys-scanner.com` (1 observation).

- Traceroute Anomalies:

- RTT discrepancy: 35ms vs. minimum possible 152.5ms for 7,626km distance.

- Geo-plausibility: False (discrepancy between claimed and actual coordinates).

- Geolocation Updates:

- Multiple entries from MaxMind geolite2 (latitude: 37.751, longitude: -97.822).

---

**4. Subnet Context**

• Subnet: `66.132.172.0/24`
• Abuse Density: 48.39% (moderate risk).
• Neighbors:

- 93 total IPs in subnet.

- 13 active IPs (39% of subnet).

- 45 IPs with elevated risk scores (high/medium).

- Notable neighbors:

- `66.132.172.34` (risk: 50/60), `66.132.172.36` (risk: 50/60).

---

**5. Relationships**

• Linked Entities:

- Censys, Inc. (same network, ASN 398324).

- DNS hostnames: `censys-scanner.com` (multiple PTR records).

- No connections to known malicious organizations or domains.

---

**6. Recommendations**

• Monitor:

- Track DNS and geolocation anomalies (RTT discrepancies, geo-plausibility).

- Watch for changes in subnet abuse density or neighbor risk scores.

• Investigate:

- Verify if `censys-scanner.com` is a legitimate service or potential spoofing target.

- Validate BGP route stability and DNSSEC integrity.

• Firewall Rules:

- No immediate action required for this IP (low risk).

- Consider blocking high-risk neighbors in the `66.132.172.0/24` subnet if allowed.

Conclusion: This IP is associated with Censys, Inc. and shows no direct malicious activity. However, the subnet contains a mix of low and moderate-risk IPs, and the DNS/geolocation anomalies warrant further investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.