# 184.178.172.28 — IP Intelligence Summary

184.178.172.28 is an IPv4 address operated by Cox Communications Inc. (AS22773), geolocated to Roanoke, United States. Its reverse DNS name is wsip-184-178-172-28.rn.hr.cox.net. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/184.178.172.28
- Last updated: 2026-10-06

## Ownership

- Organization: Cox Communications Inc.
- Network name: NETBLK-SD-RDC-DSG-184-178-160-0
- Allocated block: 184.178.160.0/20
- ASN: AS22773 (https://ipdebrief.com/asn/22773)
- Regional registry: ARIN

## Location

- City: Roanoke
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- wsip-184-178-172-28.rn.hr.cox.net
- Forward-confirmed: yes

## Analyst narrative

\# IP Intelligence Briefing: 184.178.172.28/32

**Classification:** Low Risk / Infrastructure IP

**Date:** July 24, 2026

**Jurisdiction:** United States (New York)

\## Executive Summary

IP address 184.178.172.28 is a low-risk infrastructure address associated with Cox Communications (ASN 22773). The address shows no active threat indicators, no open ports, and no evidence of malicious activity. Historical data indicates minimal threat persistence with no persistent malicious behavior observed.

\## Risk Assessment

| Metric | Value |

|--------|-------|

| Overall Risk Score | 0 |

| Provider Score | 0 |

| Authority Score | 0 |

| Abuse Confidence | None detected |

| Blacklist Status | Clean (0 listings) |

| Network Role | Firewalled / No Services |

\## Technical Profile

**Geolocation:**

\- Country: United States

\- Region: New York (US-NY)

\- ASN: 22773 (Cox Communications Inc.)

\- CIDR Block: 184.176.0.0/12

**Network Characteristics:**

\- Open Ports: None detected

\- DNS Resolution: cox.net (confirmed)

\- DNSSEC: Valid

\- Email Auth: SPF and DMARC records configured

\- PTR Records: None

**Services:**

\- No active services detected

\- Connection type: Firewalled

\## Behavioral Analysis

**Threat Indicators:**

\- Is Tor Exit Node: No

\- Known Attacker: No

\- Spam Source: No

\- Honeypot Hits: 0

\- Enumeration Strikes: 0

\- WAF Violations: 0

**Campaign Correlation:**

\- No associated campaigns detected

\- No correlated IPs identified

\- Certificate matches: 0

\## Neighborhood Analysis (184.178.172.0/24)

**Subnet Risk Profile:**

\- Total Siblings: 8

\- Abuse Density: 0

\- Risk Distribution: 0 high / 2 medium / 4 low risk

**Notable Neighbors:**

\- 184.178.172.11: Risk Score 55, Authority Score 60 (medium concern)

\- 184.178.172.13: Risk Score 45, Authority Score 60 (medium concern)

The target IP shares its /24 subnet with 8 other addresses. Two neighboring IPs show elevated risk scores (45-55), suggesting the subnet may have historical abuse activity, though the target IP itself remains clean.

\## Historical Observations

**Signal History (12 observations):**

\- Recent DNS resolution to cox.net with valid DNSSEC

\- ASN registration confirmed: Cox Communications (allocated 2010-05-14)

\- Email authentication records properly configured

\- Some historical listings observed with "high" severity classification

**Temporal Analysis:**

\- Ownership changes: 0

\- Threat persistence days: 0

\- Threat observation count: 0

\- Persistently Malicious: No

\## Recommended Actions

**For SOC Teams:**

\- Monitor the target IP for changes in risk profile

\- Note that neighboring IPs (184.178.172.11, 184.178.172.13) show elevated risk scores

\- No immediate blocking required; standard monitoring sufficient

**Firewall Rules:**

\- No specific blocking rules recommended

\- Standard ingress/egress rules apply

\## Intelligence Confidence

**Overall Confidence:** Low (0/100)

**Data Sufficiency:** Limited data available for comprehensive assessment

**Recommendation:** Continue passive monitoring; no immediate threat detected

\---

*Intelligence generated by IPDebrief Platform. Data based on real-time observation and historical signal analysis.*

## Nearby addresses

- 184.178.172.3 (https://ipdebrief.com/184.178.172.3)
- 184.178.172.5 (https://ipdebrief.com/184.178.172.5)
- 184.178.172.11 (https://ipdebrief.com/184.178.172.11)
- 184.178.172.12 (https://ipdebrief.com/184.178.172.12)
- 184.178.172.13 (https://ipdebrief.com/184.178.172.13)
- 184.178.172.14 (https://ipdebrief.com/184.178.172.14)
- 184.178.172.17 (https://ipdebrief.com/184.178.172.17)
- 184.178.172.18 (https://ipdebrief.com/184.178.172.18)
- 184.178.172.25 (https://ipdebrief.com/184.178.172.25)

---

Source: IPDebrief, "184.178.172.28 IP intelligence", https://ipdebrief.com/184.178.172.28, updated 2026-10-06. Assessments are probabilistic.