72.167.48.108📋 Copy

# IP INTELLIGENCE BRIEFING: 72.167.48.108/32

Classification: Moderate Risk | Owner: GoDaddy.com, LLC | Date: Current

---

## EXECUTIVE SUMMARY

IP 72.167.48.108 is a GoDaddy-owned web server with a moderate risk profile (55/100). The address operates standard web services (HTTP/HTTPS) with no active threat indicators, though it carries three DNSBL listings. Geographic validation inconsistencies suggest location probe discrepancies. No immediate blocking recommended; monitor for behavior changes.

---

## OWNERSHIP & NETWORK CONTEXT

---

## SERVICE FINGERPRINT

The IP exposes standard web server infrastructure:

• HTTP/HTTPS (ports 80, 443): Apache/2.4.52 on Ubuntu
• SSH (port 22): OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
• TLS: TLS 1.3, cipher suite TLS_AES_256_GCM_SHA384
• Certificate: Let's Encrypt (CN=swiftam.ca), valid for swiftam.ca and www.swiftam.ca
• DNS: Forward resolves to 108.48.167.72.host.secureserver.net; PTR record consistent

---

## THREAT ASSESSMENT

Risk Score: 55 (Moderate)

Threat Indicators:

• Known attacker: No
• Tor exit node: No
• Spam source: No
• Blacklist count: 0
• DNSBL listed: 3/8 total
• Campaign likelihood: None
• Known campaigns: None

Control Plane Status:

• Route stability: Unstable (route changes observed in 30 days)
• DNSSEC: Valid
• MOAS status: No
• Operator score: 0.2609 (Basic)

---

## GEOGRAPHIC ANALYSIS

Note: Geographic validation inconclusive. RTT measurement suggests probe location vs. actual endpoint discrepancy.

---

## OBSERVATION HISTORY (21 TOTAL)

Latest Signals (2026-07-29):

• HTTP service fingerprinting: Apache/2.4.52, HSTS disabled, CSP absent
• DNS ownership data: GoDaddy.com, LLC (ARIN)
• TLS scan: Ports 80, 443, 22, plus additional ports
• Ownership stability: No changes recorded
• Threat persistence: 0 days (not persistently malicious)

Historical Pattern: Consistent service infrastructure with no observed escalation in threat profile.

---

## RELATIONSHIP MAPPING

6 Relationships Identified:

• DNS associations to 108.48.167.72.host.secureserver.net (3 instances)
• Same network: GO-DADDY-COM-LLC (2 instances)

No additional entities: No correlated IPs, no certificate matches beyond subject swiftam.ca.

---

## NEIGHBORHOOD ANALYSIS

---

## RECOMMENDED ACTIONS

Immediate: No action required. IP is standard hosting infrastructure with no active threat indicators.

Monitoring:

• Watch for DNSBL listing changes
• Monitor SSH port 22 for unauthorized access attempts
• Track route stability changes

Firewall Rules: Not recommended to block. If required by policy, implement rate limiting on SSH port 22.

---

End of Briefing

*Generated from IPDebrief intelligence platform. All data sourced from live network probes and threat feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.