185.223.152.114📋 Copy

# IP Intelligence Briefing: 185.223.152.114/32

## Executive Summary

IP address 185.223.152.114 is assigned to the IPXO network (ASN 396356) and presents a moderate risk profile (Score: 50) with minimal operator-level threat indicators. The IP is currently firewalled with no active services detected and shows no evidence of persistent malicious activity.

## Network Classification & Ownership

• ASN: 396356 (netutils-mnt)
• Organization: IPXO
• CIDR Block: 185.223.152.0/23 (RIPE registry)
• Country: United Kingdom (GB)
• Network Role: Infrastructure (Firewalled / No Services)

## Geolocation Analysis

The IP resolves to coordinates 55.38°N, -3.44°W (United Kingdom). However, geolocation validation flags indicate a physical impossibility: observed RTT of 79ms contradicts the 9,014km distance calculation. This suggests potential geolocation data quality issues or routing anomalies.

## Threat Indicators

• Known Campaigns: None detected
• Tor Exit Node: No
• Spam Source: No
• Known Attacker: No
• DNSBL Listings: 2 out of 8 threat feeds
• Abuse Confidence: Not quantified in current assessment

## Network Context & Neighborhood

The /24 subnet (185.223.152.0/24) contains 198 total IPs with 116 active. Subnet abuse density measures 4.04%, classifying the neighborhood as "clean." Risk distribution within the subnet shows:

• High Risk: 0 IPs
• Medium Risk: 17 IPs
• Low Risk: 83 IPs

## Service & DNS Analysis

• Open Ports: None detected
• TLS Certificates: None
• DNS Records: No forward resolution confirmed
• PTR Hostnames: None
• Email Authentication: SPF/DMARC not configured (no domain detected)

## Observation History

Sixteen observations recorded through July 30, 2026, show:

• No ownership changes
• No persistent malicious behavior
• No threat persistence patterns
• Classification remains "clean" with inherited risk score of 1

## Recommended Actions

Given the moderate risk score and firewalled state with no active services:

1. Monitor: Continue passive monitoring for service openings

2. No Immediate Block: No actionable firewall rules recommended based on current threat profile

3. Verify Geolocation: Investigate RTT/distance discrepancy for data quality assessment

4. Monitor Subnet: Track the 8 threat siblings within the /24 subnet for correlated activity

Assessment: This IP presents a low-to-moderate threat profile appropriate for standard monitoring without immediate blocking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.