# 184.178.172.18 — IP Intelligence Summary 184.178.172.18 is an IPv4 address operated by Cox Communications Inc. (AS22773), geolocated to Roanoke, United States. Its reverse DNS name is wsip-184-178-172-18.rn.hr.cox.net. As of October 4, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/184.178.172.18 - Last updated: 2026-10-04 ## Ownership - Organization: Cox Communications Inc. - Network name: NETBLK-SD-RDC-DSG-184-178-160-0 - Allocated block: 184.178.160.0/20 - ASN: AS22773 (https://ipdebrief.com/asn/22773) - Regional registry: ARIN ## Location - City: Roanoke - Region: VA - Country: United States - Time zone: America/New_York ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (55/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - wsip-184-178-172-18.rn.hr.cox.net - Forward-confirmed: yes ## Analyst narrative \## IP Intelligence Briefing: 184.178.172.18/32 **Classification:** HIGH RISK | **Risk Score:** 70/100 | **Analysis Date:** Current \--- \### Executive Summary IP address 184.178.172.18 is a residential endpoint registered to Cox Communications Inc. (ASN 22773) within the 184.178.160.0/20 block. The IP carries a high-risk profile (70/100) due to active DNSBL listings (4 of 8 total lists) and is classified as a residential infrastructure endpoint. No active attack campaigns or known threat indicators detected, but elevated risk warrants monitoring. \--- \### Technical Profile \- **Ownership:** Cox Communications Inc. (NETBLK-SD-RDC-DSG-184-178-160-0) \- **ASN:** 22773 (Cox Communications) \- **Geolocation:** New York, US (America/New_York timezone) \- **Infrastructure Type:** Residential Endpoint \- **DNS Resolution:** wsip-172.178.184.18.rn.hr.cox.net (forward confirmed) \- **Email Authentication:** SPF and DMARC records present for cox.net domain \--- \### Threat Intelligence Indicators \- **DNSBL Status:** Listed on 4 of 8 blacklist sources \- **Known Attacker:** No \- **Tor Exit Node:** No \- **Spam Source:** No \- **Campaign Affiliation:** None detected \- **Threat Persistence:** No persistent malicious activity observed \--- \### Neighborhood Analysis The /24 subnet (184.178.172.0/24) contains 8 sibling IPs with the following risk distribution: \- **High Risk:** 0 \- **Medium Risk:** 4 (scores: 55, 55, 45, 40) \- **Low Risk:** 3 (scores: 0, 0, 0) \- **Abuse Density:** 0 (clean subnet classification) Notable high-risk siblings: 184.178.172.3, 184.178.172.11 (both risk score 55) \--- \### Historical Observations 14 signal observations recorded. Recent activity shows consistent residential classification with no ownership changes. DNSSEC validation confirmed (true). Route stability flagged as false. \--- \### Recommended Actions **Immediate Actions:** \`\`\`bash \# iptables iptables -A INPUT -s 184.178.172.18 -j DROP \# nftables nft add rule inet filter input ip saddr 184.178.172.18 drop \# nginx deny 184.178.172.18; \# pfSense 184.178.172.18/32 \`\`\` **Cloud/WAF Rules:** \- **Cloudflare WAF:** Block with expression \`ip.src eq 184.178.172.18\` \- **AWS WAF:** Add 184.178.172.18/32 to rule set \--- \### SOC Analyst Notes This residential IP exhibits elevated risk primarily due to DNSBL listings. While not a known attacker, the blacklist association suggests potential abuse history. Given the residential nature, consider: 1. **Block** at perimeter firewall if traffic is unsolicited 2. **Monitor** if traffic appears legitimate but unexplained 3. **Contextualize** with business requirements before blocking residential IPs 4. **Review** related siblings (184.178.172.3, 184.178.172.11) for correlated activity **Confidence Level:** Medium-High | **Action Priority:** Monitor/Block Based on Business Impact ## Nearby addresses - 184.178.172.3 (https://ipdebrief.com/184.178.172.3) - 184.178.172.5 (https://ipdebrief.com/184.178.172.5) - 184.178.172.11 (https://ipdebrief.com/184.178.172.11) - 184.178.172.12 (https://ipdebrief.com/184.178.172.12) - 184.178.172.13 (https://ipdebrief.com/184.178.172.13) - 184.178.172.14 (https://ipdebrief.com/184.178.172.14) - 184.178.172.17 (https://ipdebrief.com/184.178.172.17) - 184.178.172.25 (https://ipdebrief.com/184.178.172.25) - 184.178.172.28 (https://ipdebrief.com/184.178.172.28) --- Source: IPDebrief, "184.178.172.18 IP intelligence", https://ipdebrief.com/184.178.172.18, updated 2026-10-04. Assessments are probabilistic.