147.185.132.115📋 Copy

# IP Intelligence Briefing: 147.185.132.115

## Executive Summary

IP address 147.185.132.115 received a risk score of 55/100, classified as Moderate Risk. The IP belongs to Palo Alto Networks, Inc (ASN 396982) within the PAN-22 network block (147.185.132.0/22). Despite legitimate organizational attribution, the IP exhibits anomalous control plane characteristics including route instability and DNSBL listings. No active threat indicators or open services were detected.

## Ownership and Network Classification

• Organization: Palo Alto Networks, Inc
• ASN: 396982 (PAN-22)
• CIDR Block: 147.185.132.0/22
• Geolocation: Reported as United States, California (geoPlausible: false)
• Geolocation Inconsistency: RTT measurements (34ms average) contradict claimed distance of 7,626 km from probe locations, indicating potential geolocation spoofing or misreporting.

## Threat Indicators

• Blacklist Status: 0 blacklists, 3 DNSBL listings out of 8 total checks
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Open Ports: None detected
• Active Services: None detected (service purpose: Firewalled / No Services)
• Campaign Correlation: No correlated IPs or certificate matches

## Neighborhood Analysis

The /24 subnet (147.185.132.0/24) shows a clean overall classification with 0 abuse density. The neighborhood contains 56 total sibling IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 13
• Low Risk: 40
• Active Threat Siblings: 0

No threat siblings identified within the immediate subnet.

## Historical Observations

Fourteen signal observations recorded. Recent activity (2026-07-26) included:

• Network ownership confirmation (confidence: 0.95)
• Geolocation signals with low confidence (confidence: 0.35)
• Port scanning activity detected
• Multiple RTT validation violations suggesting inconsistent geolocation reporting

## Recommended Security Actions

Given the moderate risk score and control plane anomalies, the following actions are recommended:

Immediate:

• Increase logging verbosity and review recent activity from this IP
• Monitor for connection attempts from this address

Firewall Configuration:

```bash

# iptables

iptables -A INPUT -s 147.185.132.115 -j DROP

# nftables

nft add rule inet filter input ip saddr 147.185.132.115 drop

# nginx

deny 147.185.132.115;

# pfSense

147.185.132.115/32

```

Cloud Protection Platforms:

• Cloudflare WAF: Block IP with expression `ip.src eq 147.185.132.115`
• AWS WAF: Add 147.185.132.115/32 to deny list

## Analysis Notes

The IP's moderate risk score is primarily driven by control plane instability (route changes detected over 30-day period) and DNSBL presence (3 listings). The IP belongs to a legitimate security vendor, which may indicate reconnaissance or scanning activity from a compromised or misconfigured internal asset. The geolocation inconsistencies warrant further investigation to determine if this represents spoofed infrastructure or legitimate edge case routing.

No immediate malicious activity detected, but enhanced monitoring is recommended until the control plane anomalies resolve or the IP demonstrates consistent behavior patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.