185.223.152.112📋 Copy

# INTELLIGENCE BRIEFING: 185.223.152.112

Classification: Moderate Risk | Report Date: 2026-07-30 | Analyst: IPDebrief SOC

---

## EXECUTIVE SUMMARY

IP address 185.223.152.112 presents a moderate risk profile (score: 50/100) with no active threat indicators. The IP is associated with RIPE-registrant IPXO (ASN: 396356, netutils-mnt) and shows geolocation inconsistencies. No open services, Tor exit, or known malicious activity detected. Recommended action: Block at perimeter firewall.

---

## NETWORK OWNERSHIP & INFRASTRUCTURE

Network Classification: Infrastructure (firewalled/no services)

---

## GEOLOCATION ANALYSIS ⚠️

Flagged: Data Inconsistencies Detected

Assessment: Geolocation data is unreliable due to RTT distance violations. IP may be spoofed, misconfigured, or using proxy/relay infrastructure.

---

## THREAT ASSESSMENT

Neighborhood Context (185.223.152.0/24):

• Total Siblings: 198
• Active Siblings: 116
• Threat Siblings: 8
• Abuse Density: 4.04%
• Risk Distribution: 0 high, 17 medium, 83 low

---

## OBSERVATION HISTORY

16 signals observed across 2026-07-30:

• Network classification: Stable (inherited_risk: 1)
• Ownership changes: 0
• Threat observation count: 0
• Persistently malicious: false
• No campaigns correlated

Temporal Analysis: No persistent malicious behavior detected. IP appears dormant with no historical threat activity.

---

## RECOMMENDED SECURITY ACTIONS

Action Level: BLOCK (Risk Score: 50)

Firewall Rules

• iptables: `iptables -A INPUT -s 185.223.152.112 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 185.223.152.112 drop`
• nginx: `deny 185.223.152.112;`
• pfSense: `185.223.152.112/32`
• Cloudflare WAF: Block IP (risk score 50)
• AWS WAF: 185.223.152.112/32

Note: These recommendations are probabilistic and should be combined with other signals before enforcement.

---

## INTELLIGENCE NARRATIVE

This IP address belongs to the IPXO network (185.223.152.0/23) under RIPE registration. The moderate risk score reflects baseline caution rather than active malicious behavior. Critical geolocation anomalies—specifically the impossible RTT measurement of 78ms for a 9,014km distance—indicate potential IP spoofing, proxy usage, or data quality issues. No threat indicators, blacklists, or open services were detected. The /24 subnet shows low abuse density (4.04%) with 8 identified threat siblings out of 198 total addresses.

Recommendation: Apply blocking rules at perimeter defense layers. Monitor for any service openings or reputation changes. The IP's dormant status and lack of persistent malicious activity suggest low immediate threat, but geolocation inconsistencies warrant continued monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.