185.15.170.24📋 Copy

IP Intelligence Briefing: 185.15.170.24

Date: 2026-06-08

---

**1. Risk Profile**

• Risk Score: 55/100 (Moderate Risk)
• Ownership: Registered to DONATO CONTE (Italy) under ASN 57558 (METIS-AS).
• Geolocation:

- City: Tito, Basilicate, Italy

- Coordinates: 40.58°N, 15.67°E

- Timezone: Europe/Rome

• Network Role: Firewalled / No Services (no open ports or TLS certificates detected).
• DNS:

- PTR hostname: `host024-170-015-185.retemetis.net`

- No email authentication records (SPF/DKIM).

---

**2. Threat Indicators**

• No direct malicious activity detected (no indicators, blacklists, or campaigns).
• DNS Abuse: 3/8 DNSBL lists flagged the subnet (185.15.168.0/22).
• BGP:

- Origin ASN: 57558 (METIS-AS)

- Route stability: Unstable (recent route changes).

- RPKI invalidation: Not reported.

---

**3. Network Relationships**

• Subnet: 185.15.170.0/23 (METIS-V4-NET-2)
• Neighbors (24-bit subnet):

- 44 total IPs, with 13 high-risk (80/100) and 25 medium-risk (55/100).

- Notable high-risk neighbors: 185.15.170.8, 185.15.170.11, 185.15.170.22.

• Shared DNS: Linked to `retemetis.net` (host024-170-015-185.retemetis.net).

---

**4. Behavioral Observations**

• Historical Activity:

- 16 observations (2026-05-29 to 2026-06-08).

- Mixed signal confidence (0.18–0.95).

- No persistent malicious behavior.

• Traffic Patterns:

- No HTTP/HTTPS services or TLS certificates detected.

- No honeypot or enumeration activity.

---

**5. Recommended Actions**

• Firewall Blocking:

- iptables: `iptables -A INPUT -s 185.15.170.24 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 185.15.170.24 drop`

- Cloudflare WAF: Block IP with rule `ip.src eq 185.15.170.24`.

• Monitoring:

- Increase logging verbosity for traffic from this IP.

- Review neighboring IPs (e.g., 185.15.170.8, 185.15.170.11) for correlation.

• Investigation:

- Validate DNS ownership of `retemetis.net` and check for subdomain sprawl.

- Monitor BGP route stability for the 185.15.168.0/22 subnet.

---

Conclusion: This IP is part of a moderately risky subnet with no direct malicious activity. The owner is a private entity in Italy, and the IP is firewalled. While not immediately hostile, the subnet contains high-risk neighbors, warranting closer monitoring and network segmentation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.