184.178.172.18
184.178.172.18 is an IPv4 address operated by Cox Communications Inc. (AS22773), geolocated to Roanoke, United States. Its reverse DNS name is wsip-184-178-172-18.rn.hr.cox.net. As of October 4, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected.
## IP Intelligence Briefing: 184.178.172.18/32
Classification: HIGH RISK | Risk Score: 70/100 | Analysis Date: Current
---
Executive Summary
IP address 184.178.172.18 is a residential endpoint registered to Cox Communications Inc. (ASN 22773) within the 184.178.160.0/20 block. The IP carries a high-risk profile (70/100) due to active DNSBL listings (4 of 8 total lists) and is classified as a residential infrastructure endpoint. No active attack campaigns or known threat indicators detected, but elevated risk warrants monitoring.
---
Technical Profile
- Ownership: Cox Communications Inc. (NETBLK-SD-RDC-DSG-184-178-160-0)
- ASN: 22773 (Cox Communications)
- Geolocation: New York, US (America/New_York timezone)
- Infrastructure Type: Residential Endpoint
- DNS Resolution: wsip-172.178.184.18.rn.hr.cox.net (forward confirmed)
- Email Authentication: SPF and DMARC records present for cox.net domain
---
Threat Intelligence Indicators
- DNSBL Status: Listed on 4 of 8 blacklist sources
- Known Attacker: No
- Tor Exit Node: No
- Spam Source: No
- Campaign Affiliation: None detected
- Threat Persistence: No persistent malicious activity observed
---
Neighborhood Analysis
The /24 subnet (184.178.172.0/24) contains 8 sibling IPs with the following risk distribution:
- High Risk: 0
- Medium Risk: 4 (scores: 55, 55, 45, 40)
- Low Risk: 3 (scores: 0, 0, 0)
- Abuse Density: 0 (clean subnet classification)
Notable high-risk siblings: 184.178.172.3, 184.178.172.11 (both risk score 55)
---
Historical Observations
14 signal observations recorded. Recent activity shows consistent residential classification with no ownership changes. DNSSEC validation confirmed (true). Route stability flagged as false.
---
Recommended Actions
Immediate Actions:
```bash
# iptables
iptables -A INPUT -s 184.178.172.18 -j DROP
# nftables
nft add rule inet filter input ip saddr 184.178.172.18 drop
# nginx
deny 184.178.172.18;
# pfSense
184.178.172.18/32
```
Cloud/WAF Rules:
- Cloudflare WAF: Block with expression `ip.src eq 184.178.172.18`
- AWS WAF: Add 184.178.172.18/32 to rule set
---
SOC Analyst Notes
This residential IP exhibits elevated risk primarily due to DNSBL listings. While not a known attacker, the blacklist association suggests potential abuse history. Given the residential nature, consider:
1. Block at perimeter firewall if traffic is unsolicited
2. Monitor if traffic appears legitimate but unexplained
3. Contextualize with business requirements before blocking residential IPs
4. Review related siblings (184.178.172.3, 184.178.172.11) for correlated activity
Confidence Level: Medium-High | Action Priority: Monitor/Block Based on Business Impact
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cox Communications Inc. |
| ASN | AS22773 |
| Network Name | NETBLK-SD-RDC-DSG-184-178-160-0 |
| CIDR Block | 184.178.160.0/20 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | — |
🌐 DNS Intelligence
| PTR | wsip-184-178-172-18.rn.hr.cox.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | wsip-184-178-172-18.rn.hr.cox.net |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Not configured |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | End-User — Residential ISP endpoint |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS22773 |
| Network Prefix | 184.176.0.0/12 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 12% | 2 | 2 |
| routing | 8% | 1 | 1 |
| services | 8% | 1 | 1 |
| ownership | 12% | 2 | 2 |
| reputation | 8% | 1 | 2 |
| geolocation | 12% | 2 | 2 |
| Overall | 10% | 9 | 10 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-08 13:02:48 UTC |
| Last Seen | 2026-10-04 23:53:54 UTC |
| Profile Built | 2026-10-04 23:54:13 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 23 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 184.178.172.18
Who owns the IP address 184.178.172.18?
184.178.172.18 is registered to Cox Communications Inc.. The address falls within the 184.178.160.0/20 network block. Registration is held at ARIN.
Where is 184.178.172.18 located?
Geolocation data places 184.178.172.18 in Roanoke, VA, United States. The local time zone is America/New_York. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 184.178.172.18 malicious or safe?
184.178.172.18 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 184.178.172.18?
The reverse DNS (PTR) record for 184.178.172.18 is wsip-184-178-172-18.rn.hr.cox.net. This hostname is forward-confirmed, meaning it resolves back to the same address.