173.239.213.22📋 Copy

# IP Threat Intelligence Briefing: 173.239.213.22/32

Classification: Moderate Risk

Date: 2026-07-29

Analyst: IPDebrief SOC Intelligence

---

## Executive Summary

IP 173.239.213.22 is a US-based infrastructure address in Atlanta, GA, associated with Clouvider (ASN 62240). The IP presents moderate risk (score 60/100) with evidence of honeypot interactions and DNSBL listings. No active services are detected; the address appears firewalled with no open ports.

---

## Key Findings

Geolocation & Ownership

• Location: Atlanta, Georgia, US (America/New_York timezone)
• ASN: 62240 (Clouvider - Clouvider Limited, GB)
• BGP Prefix: 173.239.213.0/24
• Registration: Allocated 2010-05-06 (ARIN)

Risk Indicators

• Overall Risk Score: 60 (Moderate Risk)
• DNSBL Listings: 2 of 8 lists (max severity: high)
• Behavioral Flags: 1 honeypot hit, 1 total incident
• Network Role: Firewalled / No Services
• Active Attacker Status: Confirmed

Network State

• Open Ports: None detected
• DNS Records: No PTR, no forward resolution
• DNSSEC: Valid
• Route Stability: Unstable (isRouteStable: false)
• Honeypot Hits: 1
• Enumeration Strikes: 0

---

## Observation History

Recent monitoring (10 observations) shows:

• Current listings: 8 total, 2 active with high severity
• DNSSEC validation: Confirmed
• ASN attribution: Clouvider via team-cymru-dns
• No persistent malicious activity detected
• Risk trajectory: Stable with isolated incidents

---

## Neighborhood Analysis

Subnet: 173.239.213.0/24

• Abuse Density: 0 (clean classification)
• Total Siblings: 5 (2 active)
• Risk Distribution: 1 medium, 3 low, 0 high

Neighbor IPs:

No significant threat clusters identified in adjacent addresses.

---

## Related Entities

No relationships detected in the relationship graph (0 linked entities).

---

## Recommended Actions

Firewall Rules:

• Monitor for inbound connection attempts (honeypot activity recorded)
• Block if traffic shows reconnaissance patterns
• Apply rate limiting for potential automated scanning

SOC Guidance:

• No immediate threat blocking required
• Monitor for service activation on this IP
• Correlate with any alerts from Atlanta-based infrastructure

Priority: Medium – Address shows defensive posture but maintains DNSBL presence

---

*Intel generated from IPDebrief automated analysis. Validated against real-time threat feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.