# 71.18.162.225 — IP Intelligence Summary

71.18.162.225 is an IPv4 address operated by Bytedance Inc., geolocated to New York, United States. As of October 28, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/71.18.162.225
- Last updated: 2026-10-28

## Ownership

- Organization: Bytedance Inc.
- Network name: BYTED
- Allocated block: 71.18.0.0/16
- ASN: —
- Regional registry: ARIN

## Location

- City: New York
- Region: Virginia
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 80/tcp — http
- 443/tcp — https

## Analyst narrative

**Intelligence Briefing: 71.18.162.225/32**

The endpoint 71.18.162.225/32 presented a moderate risk reputation with a risk score of 40. Infrastructure analysis identified the address as owned by Bytedance Inc. within the 71.18.0.0/16 block. TLS certificate validation confirmed the subject identity fcdn-edge-mtls.tiktokcdn-us.com, consistent with TikTok CDN infrastructure, while the server banner indicated a Bytedance NSS implementation.

Threat intelligence categorization labeled the host as a "Suspicious Host" despite the absence of specific malicious indicators in the threat feed. Network neighborhood analysis classified the /24 subnet as mixed with an abuse density of 0.3 and identified three threat siblings among the active siblings.

Technical validation revealed a contradiction between claimed US geolocation and RTT physics measurements, noting a distance of 6327.9km against a minimum possible RTT of 126.6ms. The connection utilized HTTP/2.0 and maintained open ports 80 and 443. Due to the moderate risk classification and neighborhood context, rate-limiting actions were recommended to mitigate potential abuse.

## Nearby addresses

- 71.18.162.129 (https://ipdebrief.com/71.18.162.129)
- 71.18.162.241 (https://ipdebrief.com/71.18.162.241)
- 71.18.162.243 (https://ipdebrief.com/71.18.162.243)
- 71.18.162.244 (https://ipdebrief.com/71.18.162.244)
- 71.18.162.245 (https://ipdebrief.com/71.18.162.245)
- 71.18.162.246 (https://ipdebrief.com/71.18.162.246)
- 71.18.162.247 (https://ipdebrief.com/71.18.162.247)
- 71.18.162.252 (https://ipdebrief.com/71.18.162.252)
- 71.18.162.253 (https://ipdebrief.com/71.18.162.253)
- 71.18.162.254 (https://ipdebrief.com/71.18.162.254)
- 71.18.162.255 (https://ipdebrief.com/71.18.162.255)

## Addresses sharing infrastructure

- 71.18.8.236 — Same TLS certificate (https://ipdebrief.com/71.18.8.236)
- 71.18.10.234 — Same TLS certificate (https://ipdebrief.com/71.18.10.234)
- 71.18.10.248 — Same TLS certificate (https://ipdebrief.com/71.18.10.248)
- 71.18.43.226 — Same TLS certificate (https://ipdebrief.com/71.18.43.226)
- 71.18.43.242 — Same TLS certificate (https://ipdebrief.com/71.18.43.242)
- 71.18.50.230 — Same TLS certificate (https://ipdebrief.com/71.18.50.230)
- 71.18.53.165 — Same TLS certificate (https://ipdebrief.com/71.18.53.165)
- 71.18.116.251 — Same TLS certificate (https://ipdebrief.com/71.18.116.251)
- 71.18.116.252 — Same TLS certificate (https://ipdebrief.com/71.18.116.252)
- 71.18.116.253 — Same TLS certificate (https://ipdebrief.com/71.18.116.253)
- 71.18.123.252 — Same TLS certificate (https://ipdebrief.com/71.18.123.252)
- 71.18.125.228 — Same TLS certificate (https://ipdebrief.com/71.18.125.228)

---

Source: IPDebrief, "71.18.162.225 IP intelligence", https://ipdebrief.com/71.18.162.225, updated 2026-10-28. Assessments are probabilistic.