173.225.111.78📋 Copy

# IP Intelligence Briefing: 173.225.111.78/32

## Executive Summary

IP address 173.225.111.78 is a moderate-risk (55/100) infrastructure endpoint owned by Interserver, Inc (ASN 19318). The address hosts within the 173.225.96.0/20 block and presents elevated risk primarily through open RDP services and DNSBL listings. No active threat indicators were detected, but monitoring is recommended due to service exposure.

---

## Infrastructure Profile

Ownership: Interserver, Inc | ASN 19318 | Network: INTER-83

Registration: ARIN | CIDR Block: 173.225.96.0/20

Geolocation: United States (2500km accuracy radius)

Network Role: Single-Service Host | Not classified as CDN, Cloud, VPN, or Proxy

---

## Risk Assessment

Overall Risk Score: 55 (Moderate)

Abuse Confidence: Not applicable

DNSBL Listings: 3 of 8 total lists

Operator Score: 0.1304 (Minimal)

Risk Factors Identified:

• Elevated risk score (55/100)
• 3 DNSBL blacklist entries
• Non-stable BGP route (route changes detected)
• Open RDP port 3389 exposed to internet

Mitigating Factors:

• No known attacker or spam source flags
• Not a Tor exit node
• Clean subnet classification (abuse density: 0)
• No persistent malicious behavior observed

---

## Network Services

Open Ports:

• TCP/3389 (RDP) - Remote Desktop Protocol

DNS Analysis:

• No forward resolution
• No hosted domains
• No email authentication (SPF/DMARC)
• DNSSEC validated: Yes

---

## Threat Intelligence

Threat Indicators: None detected

Known Campaigns: None

Blacklist Sources: 3 listings (specific feeds not enumerated)

Campaign Likelihood: Not correlated

Observation History: 16 signals observed

• Recent activity: Port scanning detected (2026-07-30)
• No ownership changes recorded
• Threat persistence: 0 days
• Persistently malicious: No

---

## Neighborhood Analysis

Subnet: 173.225.111.78/24

Abuse Density: 0 (Clean)

Neighbor Count: 0

Threat Siblings: 0

Classification: Clean

---

## Recommended Actions

Immediate Recommendations

1. Monitoring: Increase logging verbosity and review recent activity from this IP

2. Firewall: Consider blocking or rate-limiting based on organizational policy

Platform-Specific Rules

iptables:

```

iptables -A INPUT -s 173.225.111.78 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 173.225.111.78 drop

```

nginx:

```

deny 173.225.111.78;

```

pfSense:

```

173.225.111.78/32

```

Cloudflare WAF:

```json

{"description":"Block 173.225.111.78 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 173.225.111.78"}}

```

AWS WAF:

```json

{"Addresses":["173.225.111.78/32"],"Description":"IPDebrief risk 55"}

```

---

## Intelligence Narrative

The IP 173.225.111.78 is a commercial hosting endpoint that presents moderate risk due to exposed RDP services and DNSBL listings. While no active attack signatures were detected, the open RDP port represents a potential lateral movement vector if compromised. The subnet shows zero abuse density, indicating this is an isolated risk rather than part of a coordinated campaign. SOC analysts should monitor for port scanning activity and consider blocking based on RDP exposure policies. The IP's BGP route instability suggests potential hosting infrastructure changes that may affect long-term threat assessment.

Classification: Moderate Risk - Monitor

Last Updated: 2026-07-30

Data Source: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.