185.15.168.195📋 Copy

# IP Intelligence Briefing: 185.15.168.195/32

Classification: High Risk Threat Actor

Date: 2026-06-23

Risk Score: 80/100

---

## Executive Summary

IP address 185.15.168.195 is a high-risk web server located in Tito, Basilicate, Italy (ASN 57558, Organization: DONATO CONTE). The IP exhibits elevated threat indicators with recent blacklist listings, operates within a high-abuse neighborhood (0.5556 abuse density), and runs a lighttpd web server with SSH access. Immediate defensive action is recommended.

---

## Key Findings

Network Profile

• Organization: DONATO CONTE (ASN 57558)
• Location: Tito, Basilicate, Italy
• Geolocation Accuracy: 500km radius
• DNS PTR: host195-168-015-185.retemetis.net
• BGP Prefix: 185.15.168.0/22
• Route Stability: Unstable (no route changes in 30 days)

Service Exposure

• Open Ports: 80/tcp (HTTP), 443/tcp (HTTPS), 22/tcp (SSH)
• Web Server: lighttpd/1.4.39
• SSH Banner: SSH-2.0-dropbear (curve25519-sha256, diffie-hellman-group14-sha256)
• TLS Certificate: None detected

Threat Indicators

• DNSBL Listings: 2 of 8 total lists
• Blacklist Count: 0 (current snapshot)
• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

---

## Neighborhood Analysis

The /24 subnet (185.15.168.0/24) shows concentrated abuse activity:

• Abuse Density: 0.5556 (classified as high_abuse)
• Total Siblings: 18
• Active Siblings: 9
• Threat Siblings: 10 (55.6% of active neighbors are malicious)
• High-Risk Neighbors: 7 IPs with risk scores of 80/100

Notable high-risk neighbors include 185.15.168.129, 185.15.168.130, 185.15.168.152, 185.15.168.164, 185.15.168.170, 185.15.168.179, and 185.15.168.192.

---

## Observation History

Analysis of 22 historical observations reveals:

• Multiple blacklist listings with high-severity classifications
• Recent connection failures detected (2026-06-22)
• Persistent threat observations with 85% confidence
• Geographic inference consistently points to Italy (41.87°N, 12.57°E)

---

## Recommended Actions

Immediate Mitigation

```bash

# Block at firewall/ingress level

iptables -A INPUT -s 185.15.168.195 -j DROP

nft add rule inet filter input ip saddr 185.15.168.195 drop

```

Application-Level Protection

• Nginx: `deny 185.15.168.195;`
• pfSense: Add 185.15.168.195/32 to block list
• Cloudflare WAF: Block rule with expression `ip.src eq 185.15.168.195`
• AWS WAF: Add 185.15.168.195/32 to IP set

Monitoring Requirements

• Increase logging verbosity for traffic from this IP
• Review recent activity logs for potential compromise indicators
• Monitor the /24 subnet for coordinated activity patterns

---

## Intelligence Assessment

This IP represents a legitimate but risky web hosting asset operating in a high-abuse environment. The combination of elevated risk score, neighborhood abuse density, and historical blacklist activity warrants defensive blocking. The lack of TLS certificates and presence of SSH access increase potential attack surface. SOC teams should treat this IP as malicious until proven otherwise, while acknowledging the possibility of legitimate business use requiring risk-based exceptions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.