185.223.152.199📋 Copy

# IP Intelligence Briefing: 185.223.152.199/32

Classification: Low Risk | Report Date: 2026-07-28 | Analyst: IPDebrief SOC Team

## Executive Summary

IP 185.223.152.199 is a low-risk infrastructure address with a risk score of 25. The IP operates under netutils-mnt (IPXO) within the 185.223.152.0/23 CIDR block. No active threat indicators, blacklist listings, or malicious behavior were detected. The subnet maintains a clean classification with minimal abuse density (0.0155).

## Network Ownership & Registration

• ASN: 396356 (netutils-mnt / IPXO)
• CIDR Block: 185.223.152.0/23
• RIR: RIPE
• Abuse Contact: Available via RDAP
• Network Role: Firewalled / No Services

## Geolocation Analysis

Primary Location: United Kingdom (GB)

Claimed Location: Boston, US-MA

*Note: Geolocation validation flagged an RTT anomaly. The observed minimum RTT of 77ms contradicts the claimed distance of 9014km (minimum possible RTT should be 180.3ms). This discrepancy indicates the geolocation data may be inaccurate or the IP is not operating at the claimed location.*

Traceroute Analysis:

• Total Hops: 13
• Transit Networks: Comcast, GTT
• Timeouts: 1 hop
• Minimum RTT: 77ms
• Average RTT: 79.4ms

## Threat Intelligence Assessment

• Risk Score: 25 (Low Risk)
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: None matched
• Campaign Correlation: None

Threat Indicators: None detected across all threat feeds and sources.

## Neighborhood Analysis (185.223.152.0/24)

• Abuse Density: 0.0155 (very low)
• Subnet Classification: Clean
• Total Siblings: 193
• Active Siblings: 46
• Threat Siblings: 3 (6.5% of active peers)
• Risk Distribution: 84 low-risk, 10 medium-risk, 0 high-risk

Key Neighboring IPs:

## Observation History

Total Observations: 17 signals recorded on 2026-07-28

Recent activity includes:

• Traceroute probes (13 hops, successful target reach)
• Network role classification (firewalled/no services)
• Geolocation validation (inconsistent RTT data)
• Subnet abuse density assessment (clean classification)

No evidence of persistent malicious behavior or threat persistence detected.

## Relationship Graph

• Primary Association: IPXO network (185.223.152.0/23)
• Related Entities: None beyond same-network classification

## Recommended Security Actions

Current Status: No immediate action required

The IP presents as benign infrastructure with no active threat signals. Standard monitoring is appropriate. Consider the geolocation inconsistency when validating source claims, though this does not indicate malicious activity.

Firewall Rules: None generated (risk score below threshold)

---

Bottom Line: IP 185.223.152.199 is a low-risk infrastructure address belonging to IPXO (netutils-mnt). The subnet demonstrates minimal abuse activity. Geolocation inconsistencies warrant awareness but do not indicate malicious operation. No blocking or filtering recommended at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.