173.239.224.244📋 Copy

# IP Intelligence Briefing: 173.239.224.244/32

## Executive Summary

IP address 173.239.224.244 is classified as LOW RISK with a risk score of 20/100. The IP belongs to LOGICWEB (ASN 396356), registered under ARIN RIR. The address shows no active threat indicators, no open services, and operates within a clean /24 subnet with minimal abuse density. No firewall blocking or filtering actions are recommended at this time.

---

## Ownership & Registration

• Organization: Private Customer (LOGICWEB)
• ASN: 396356
• CIDR Block: 173.239.224.0/24
• RIR: ARIN
• Registration Date: Not available in current records

---

## Geolocation Assessment

• Country: United States (US)
• Region: Massachusetts (MA) - Boston
• Geolocation Confidence: Moderate
• Geolocation Consensus: Confirmed across multiple sources (geoSourceCount: 2)
• Note: RTT-based geolocation validation shows a 7,997 km distance claim with 60ms RTT, which violates minimum possible RTT thresholds (159.9ms). This indicates potential geolocation data inconsistency.

---

## Threat Intelligence

• Risk Score: 20 (Low Risk)
• Blacklist Count: 0
• Abuse Confidence Score: Not applicable
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None detected
• Threat Feeds: No indicators present

---

## Network Behavior & Services

• Network Role: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Connection Type: Firewalled

---

## DNS Analysis

• PTR Hostnames: None
• Forward Resolution: No forward resolution (forwardConfirmed: false)
• Hosted Domains: 0
• Email Authentication: SPF: No, DMARC: No, TXT Records: 0
• DNSBL Listed: 0 lists

---

## Neighborhood Analysis (173.239.224.0/24)

• Total Subnet Siblings: 81
• Active Siblings: 18
• Threat Siblings: 1
• Abuse Density: 0.0123 (Very Low)
• Classification: Clean
• Inherited Risk: 0

Risk Distribution in /24:

• High Risk: 0
• Medium Risk: 3
• Low Risk: 77

---

## Historical Observations

• Total Observations: 14
• Threat Persistence Days: 0
• Persistence Classification: Not persistently malicious
• Recent Activity: No significant threat behavior observed in history

Recent Geolocation Signals:

• Multiple conflicting location reports (Dallas, TX claimed vs. Boston, MA geolocation)
• Confidence levels ranged from 0.30 to 0.85
• RTT inconsistencies detected in geolocation validation

---

## Relationship Graph

• Primary Association: LOGICWEB network (3 relationship entries)
• Network Type: Same Network
• Associated Entities: Network-level relationships only

---

## Recommended Security Actions

Current Risk Level: LOW

Recommended Actions: None

• No firewall rules or blocking recommendations generated
• IP does not meet thresholds for aggressive filtering
• Standard monitoring and logging recommended

---

## Intelligence Assessment

This IP address represents a low-risk infrastructure endpoint with no evidence of malicious activity. The LOGICWEB organization maintains a clean security posture within the /24 subnet. While geolocation data shows minor inconsistencies (common for hosted infrastructure), no threat indicators are present. The address is not associated with any known campaigns, blacklists, or malicious behavior patterns.

SOC Analyst Guidance:

• No immediate action required
• Standard traffic monitoring sufficient
• No firewall rules recommended for this IP
• Continue periodic monitoring for any behavioral changes

---

*Intelligence generated by IPDebrief Threat Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.