69.163.136.138
Intelligence Briefing: IP 69.163.136.138
The target address, 69.163.136.138, was associated with ASN 26347 (DreamHost, Netname: DH-PDX1-01) located in Hillsboro, Oregon. Ownership records indicated a risk score of 25, categorized as Low Risk. The network role was identified as a Web Server, operating services on ports 80 and 443 via nginx/1.28.1 with PHP/8.1.2 backend. DNS records confirmed the PTR hostname as webmail-pdx1.dreamhost.com, with SPF and DMARC authentication enabled.
Threat analysis showed no known attacker indicators, Tor exit status, or active campaign correlations. Blacklist data indicated zero counts in the primary threat feed, though one DNSBL listing was recorded in control plane data. The immediate neighborhood (69.163.136.138/24) was classified as clean with zero threat siblings and three active siblings.
Observations spanned from 2026-09-06 to 2026-09-15. Validation checks identified a contradiction between claimed geolocation and RTT physics measurements (87ms observed vs 162.2ms minimum possible for 8107.3km distance). The operator score was rated as Minimal. Due to signal contradictions, the recommended action was to Monitor with low severity.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | DreamHost |
| ASN | AS26347 |
| Network Name | DH-PDX1-01 |
| CIDR Block | 69.163.128.0/17 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | webmail-pdx1.dreamhost.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | webmail-pdx1.dreamhost.com |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | nginx/1.28.1 |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.dreamhost.comdreamhost.com |
| Valid From | 2025-12-04T00:00:00+00:00 |
| Valid Until | 2026-12-21T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 382 days |
| Serial Number | 00CAB3B9B952DDB2EEC3BFDD30156CF504 |
| Thumbprint | CE8E3C1EBF79C33FA0C6E42AA267489E32C41F5F |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 43% | 2 | 5 |
| routing | 13% | 1 | 1 |
| services | 29% | 2 | 4 |
| ownership | 19% | 2 | 2 |
| reputation | 28% | 1 | 3 |
| geolocation | 33% | 2 | 4 |
| Overall | 27% | 10 | 19 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-06 15:05:40 UTC |
| Last Seen | 2026-09-15 00:43:23 UTC |
| Profile Built | 2026-09-15 00:53:57 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 33 |
Full dossier details are available via our API.