89.149.212.50
IP address 89.149.212.50 resided within the LEASEWEB-NL-MNT network (ASN 60781) located in Amsterdam, Netherlands. Risk assessment classified the asset as Low Risk with a score of 25. Network services included HTTP and HTTPS on ports 80 and 443, with TLS certificates issued by DigiCert Inc for *.5now.co.il. HTTP/2.0 probing returned a 503 status code.
Threat indicators revealed one DNSBL listing across eight total lists, though the address was not flagged as a known attacker, spam source, or Tor exit. Behavioral analysis recorded zero total incidents, zero honeypot hits, and zero enumeration strikes. The neighborhood classification remained clean with zero abuse density and two active sibling addresses.
Although a threat actor tag labeled the host as suspicious, no known campaigns correlated with the IP. Route stability status recorded as false for the 89.149.192.0/18 prefix. Operational guidance recommended monitoring the endpoint due to low severity findings and the clean neighborhood classification.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | LEASEWEB-NL-MNT |
| ASN | AS60781 |
| Network Name | NL-LEASEWEB-20060223 |
| CIDR Block | 89.149.192.0/18 |
| RIR | RIPE |
| Country | NL |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 0% (None) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
CN=*.5now.co.il was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | *.5now.co.il5now.co.il |
| Valid From | 2024-09-24T00:00:00+00:00 |
| Valid Until | 2025-09-23T23:59:59+00:00 (expired) |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 364 days |
| Serial Number | 03D845DC48B5143C2B57685BBC52F382 |
| Thumbprint | 2924E94B6B0B09D1B17CAF680AB5D934318BD035 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 33% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 33% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 35% | 2 | 3 |
| Overall | 26% | 10 | 17 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-07 00:45:05 UTC |
| Last Seen | 2026-09-23 12:33:04 UTC |
| Profile Built | 2026-09-23 12:43:07 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 32 |
Full dossier details are available via our API.