174.175.21.121📋 Copy

## IP Intelligence Briefing: 174.175.21.121/32

Classification: Low Risk

Risk Score: 25/100

Date: July 2026

Executive Summary

IP address 174.175.21.121 is a Comcast residential infrastructure endpoint (AS7922) with a low-risk profile. The address is firewalled with no open services detected. Recent port scanning activity was observed, and the IP appears on one DNS blacklist out of eight total lists. No active malicious campaigns or known attacker associations were identified.

Ownership and Geolocation

• Organization: Comcast Cable Communications, LLC
• ASN: AS7922
• Location: Wilkes-Barre, Pennsylvania, United States
• DNS Hostname: c-174-175-21-121.hsd1.pa.comcast.net
• Geolocation Confidence: 35% (accuracy radius: 2,500 km)

Network Behavior and Services

• Network Role: Firewalled / No Services
• Open Ports: None detected
• TLS/Certificate: Not applicable
• HTTP Title: Not available
• Control Plane: BGP prefix 174.160.0.0/11, origin ASN 7922
• DNSBL Status: Listed on 1 of 8 threat feeds

Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Abuse Confidence Score: Not determined
• Campaign Likelihood: None
• Threat Persistence Days: 0
• Total Incidents: 0

Observed Activity

Recent signal observations indicate:

• Port scanning activity detected (July 29, 2026)
• Alienvault OTX threat indicator with confidence 0.75
• Operator score classified as "Basic" (0.2609)
• 16 total signal observations recorded

Subnet Analysis (174.175.21.0/24)

• Neighbor Count: 1 (174.175.21.195)
• Abuse Density: 0
• Neighbor Risk Score: 0
• Overall Risk Distribution: 1 low-risk address

Recommended Actions

No specific firewall rules or blocking recommendations generated based on current risk profile. The low risk score (25) and absence of malicious indicators suggest continued monitoring is sufficient.

SOC Analyst Notes

This IP represents a Comcast residential endpoint with no evidence of active malicious activity. The port scanning signals are consistent with routine network reconnaissance or automated scanning. The single DNSBL listing requires context but does not indicate active abuse. No correlation to known threat campaigns or associated malicious infrastructure.

Recommended Handling: Monitor for changes in risk profile. No immediate blocking action warranted based on current data.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.