185.213.175.224📋 Copy

IP Intelligence Briefing: 185.213.175.224

Date: 2026-06-17

---

**1. Risk Profile**

• Overall Risk: Moderate (Risk Score: 50)
• Threat Indicators: 2 high-severity threats detected in the last 30 days (listed on 8 threat feeds).
• Network Role: Single-service host (SSH on port 22).
• Geolocation: Netherlands (NL), Paterna, latitude 52.13, longitude 5.29.

---

**2. Ownership & Network**

• ASN: AS41608 (es-nextgenwebs-1-mnt, RIPE).
• Subnet: 185.213.175.224/24.
• Subnet Abuse Density: 0.2 (mostly clean, 4 medium-risk neighbors, 7 low-risk neighbors).
• Neighbors:

- 4 IPs with medium risk (25–50 score).

- 7 IPs with low risk (0–25 score).

- 1 IP (185.213.175.211) with zero risk.

---

**3. Threat Observations**

• Recent Activity:

- SSH service detected (OpenSSH 9.6p1).

- Scanned for open ports (ports 22, 80, 443, etc.).

- Traceroute shows plausible geolocation in the Netherlands (avg RTT: 108ms).

• Threat Feeds: Listed on 2 high-severity threat lists (e.g., AlienVault OTX).

---

**4. Relationships**

• Network Affiliation: Part of "NextGenWebs-NL" network (RIPE).
• Linked Entities:

- No direct ties to known malicious organizations.

- Subnet shows mixed risk but no confirmed malicious activity.

---

**5. Recommendations**

1. Monitor SSH Service: Investigate SSH access logs for unauthorized activity.

2. Review Neighbors: Focus on IPs with medium risk (e.g., 185.213.175.121, 175.140) for potential lateral movement.

3. Firewall Rules:

- Block or monitor traffic from this IP based on risk score.

- Consider rate-limiting SSH attempts to prevent brute-force attacks.

4. Geolocation Verification: Confirm if the Netherlands-based IP aligns with expected network activity.

---

Tools Used: `ipdebrief_profile`, `ipdebrief_history`, `ipdebrief_relationships`, `ipdebrief_neighbors`.

Classification: Moderate Risk | Subnet: Mostly Clean | Action Required: Yes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.