185.213.193.228📋 Copy

# IP Intelligence Briefing: 185.213.193.228

Classification: Low Risk | Date: 2026-07-29 | Status: Active Monitoring

---

## Executive Summary

IP 185.213.193.228 presents a low-risk profile (Score: 25/100) with no active threat indicators. The address is registered to Mullvad VPN AB abuse handling within the 185.213.193.128/25 CIDR block. No open services, no known malicious campaigns, and no blacklist entries were detected. The subnet exhibits "mostly_clean" classification with minimal abuse density (0.3333).

---

## Ownership & Infrastructure

The IP is assigned to Mullvad VPN's abuse handling infrastructure, consistent with VPN provider operational patterns. Geolocation reports indicate New York, US, though historical signals show Gothenburg, Sweden (SE-40014), suggesting VPN routing characteristics.

---

## Network & Service Analysis

The IP shows no active network services, consistent with an abuse handling or backplane IP. Control plane analysis indicates route stability is false with minimal operator score (0.1304).

---

## Threat Indicators

No threat feeds, known campaigns, or malicious reputation sources were associated with this address.

---

## Neighborhood Analysis

Subnet: 185.213.193.228/24

Abuse Density: 0.3333 (Low)

Classification: Mostly Clean

The /24 subnet contains 2 additional active neighbors, both exhibiting similar low-risk profiles (Score: 25). No high-risk siblings were identified within the neighborhood.

---

## Observation History

Total Observations: 13

Timeframe: Recent monitoring period

Key historical signals:

• Port scans detected with no open services
• Ownership consistently attributed to Mullvad VPN AB abuse handling
• Geolocation signals showed mixed reporting (US-NY and SE-Gothenburg)
• No changes in threat status or ownership
• No persistent malicious activity detected

---

## SOC Recommendations

1. Allow Traffic: Low-risk profile with no active threat indicators. Standard inspection recommended.

2. Monitor: Track for any service activation or reputation changes.

3. No Blocking Required: Does not meet threshold for immediate firewall blocking.

4. Context: VPN abuse handling IP—monitor for potential abuse reporting activity but not indicative of active compromise.

---

## Related Entities

• Network: MULLVA-185-213-193-128 (Same Network)
• ASN: 21859 (Origin)

No external hostnames, organizations, or certificates linked to this IP.

---

Report Generated: IPDebrief Intelligence Platform

Analysis Confidence: High (13 observation points, consistent ownership)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.