66.175.213.4📋 Copy

## IP INTELLIGENCE BRIEFING: 66.175.213.4

Classification: Moderate Risk / Scanning Infrastructure

Risk Score: 55/100

Last Updated: 2026-06-16

---

OWNERSHIP & INFRASTRUCTURE

Organization: Linode (ASN 63949)

Network: 66.175.208.0/20

Location: Cedar Knolls, NJ, US

Infrastructure Type: Cloud Compute / Hosting

Status: Active cloud infrastructure with firewalled/no services detected

THREAT INDICATORS

Primary Indicators:

• Reverse DNS: `vilnius.scan.bufferover.run`
• DNS Association: Bufferover vulnerability scanning service
• Blacklist Status: Not listed on major blacklists
• Threat Observation Count: 1

Risk Assessment:

The IP resolves to a Bufferover scanning service hostname, indicating association with automated vulnerability scanning infrastructure. While the IP is not flagged as a known attacker or spam source, the DNS association suggests reconnaissance activity. Risk score of 55 reflects moderate concern due to scanning service affiliation.

NETWORK CONTEXT

Neighborhood Analysis (66.175.213.0/24):

• Subnet Classification: Mostly Clean
• Abuse Density: 0-1 (low threat concentration)
• Threat Siblings: 1
• Total Active Siblings: 1

Relationship Graph:

• 19 relationship entries identified
• Primary associations: LINODE network infrastructure
• DNS associations: Multiple entries pointing to `vilnius.scan.bufferover.run`

OBSERVATION HISTORY

Temporal Analysis:

• Total Observations: 21
• Threat Persistence: Single observation (not persistent)
• Ownership Changes: 0 (stable ownership)
• Recent Activity: Consistent scanning service association

RECOMMENDED ACTIONS

SOC Analyst Guidance:

1. Monitor but do not block: The IP is not actively malicious but represents scanning infrastructure. Allow-list consideration if legitimate vulnerability scanning is required.

2. Correlate DNS activity: Investigate `vilnius.scan.bufferover.run` for broader scanning campaigns.

3. Review egress/ingress: If this IP is observed scanning your infrastructure, it may be part of legitimate security testing or potentially unauthorized reconnaissance.

4. Monitor subnet trends: The 66.175.213.0/24 subnet shows low abuse density. Track for escalation.

Firewall Recommendation: No immediate action required. If scanning activity is detected against your systems, implement rate limiting or geolocation-based restrictions pending further investigation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.