169.224.0.251📋 Copy

# IP Intelligence Briefing: 169.224.0.251/32

## Executive Summary

IP 169.224.0.251 is classified as Low Risk with a risk score of 25/100. The address is owned by ASN 199739 (ae-earthlink-dmcc-1-mnt) within the 169.224.0.0/17 CIDR block. Geolocation data places the IP in Baghdad, Iraq. The endpoint shows no active services (firewalled/no services), no open ports, and no certificate data.

## Ownership & Network Context

• ASN: 199739
• Organization: ae-earthlink-dmcc-1-mnt
• Netname: AE-EARTHLINK-DMCC-19950607
• CIDR Block: 169.224.0.0/17
• RIR: ARIN
• Registration Date: 1995-06-07
• Abuse Contact: Available via RDAP

The IP is associated with the same network entity (AE-EARTHLINK-DMCC-19950607) across all relationship records.

## Threat Indicators

• Blacklist Status: Listed on 8 DNSBL lists with 1 high-severity listing
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: No associated campaigns detected

The 1 DNSBL listing represents a moderate concern requiring review against threat intelligence feeds, though no active threat indicators (scans, attacks, malicious reputation) are currently present.

## Network Role & Services

• Classification: Firewalled / No Services
• Open Ports: None
• TLS Certificate: None
• HTTP Service: None detected
• Cloud/CDN/Proxy: No
• Is Bogon: No

## Geolocation

• Country: Iraq (IQ)
• City: Baghdad
• Region: Baghdad
• Coordinates: 33.34°N, 44.40°E
• Distance from Reference: 3,675.7 km
• Validation Status: ICMP blocked - unable to validate

## Neighborhood Analysis

The /24 subnet (169.224.0.0/24) contains 4 total sibling IPs:

• Abuse Density: 0%
• Risk Distribution: 2 High (40), 2 Medium (40), 2 Low (25)
• Notable Neighbors: 169.224.0.33 (risk: 40), 169.224.0.114 (risk: 40)

The subnet shows mixed risk levels but maintains low abuse density overall.

## Observation History

12 total observations recorded. Recent signals (2026-07-26 timeframe) indicate:

• Geo-location signals with Baghdad coordinates
• DNSSEC validation: Valid
• ASN resolution: 199739 (Earthlink-DMCC-IQ)
• Blacklist listings with high-severity categories
• No evidence of evolving malicious behavior

## Control Plane

• BGP Prefix: 169.224.0.0/22
• Route Stable: False
• RPKI State: Null
• IRR Consistency: Null
• DNSSEC Valid: True

## SOC Recommendations

1. Monitor DNSBL Listings: Review the 8 blacklist entries, particularly the high-severity listing, to determine relevance to current threat campaigns.

2. Passive Monitoring: No active blocking required; IP shows no services and is firewalled.

3. Subnet Awareness: Monitor neighbors 169.224.0.33 and 169.224.0.114 (risk score 40) for correlated activity.

4. No Immediate Action: Current risk score of 25 falls within acceptable thresholds for standard defensive operations.

## Conclusion

IP 169.224.0.251 represents a low-risk endpoint with no active threat indicators. The primary concern is the blacklist listing requiring intelligence correlation. No immediate defensive actions are warranted beyond standard monitoring protocols.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.