# 185.223.152.199 — IP Intelligence Summary

185.223.152.199 is an IPv4 address operated by netutils-mnt (AS396356), geolocated to Los Angeles, United Kingdom. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/185.223.152.199
- Last updated: 2026-10-06

## Ownership

- Organization: netutils-mnt
- Network name: IPXO
- Allocated block: 185.223.152.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: RIPE

## Location

- City: Los Angeles
- Region: CA
- Country: United Kingdom
- Time zone: Europe/London

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 185.223.152.199/32

**Classification:** Low Risk | **Report Date:** 2026-07-28 | **Analyst:** IPDebrief SOC Team

\## Executive Summary

IP 185.223.152.199 is a low-risk infrastructure address with a risk score of 25. The IP operates under netutils-mnt (IPXO) within the 185.223.152.0/23 CIDR block. No active threat indicators, blacklist listings, or malicious behavior were detected. The subnet maintains a clean classification with minimal abuse density (0.0155).

\## Network Ownership & Registration

\- **ASN:** 396356 (netutils-mnt / IPXO)

\- **CIDR Block:** 185.223.152.0/23

\- **RIR:** RIPE

\- **Abuse Contact:** Available via RDAP

\- **Network Role:** Firewalled / No Services

\## Geolocation Analysis

**Primary Location:** United Kingdom (GB)

**Claimed Location:** Boston, US-MA

*Note: Geolocation validation flagged an RTT anomaly. The observed minimum RTT of 77ms contradicts the claimed distance of 9014km (minimum possible RTT should be 180.3ms). This discrepancy indicates the geolocation data may be inaccurate or the IP is not operating at the claimed location.*

**Traceroute Analysis:**

\- Total Hops: 13

\- Transit Networks: Comcast, GTT

\- Timeouts: 1 hop

\- Minimum RTT: 77ms

\- Average RTT: 79.4ms

\## Threat Intelligence Assessment

\- **Risk Score:** 25 (Low Risk)

\- **Blacklist Count:** 0

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Threat Feeds:** None matched

\- **Campaign Correlation:** None

**Threat Indicators:** None detected across all threat feeds and sources.

\## Neighborhood Analysis (185.223.152.0/24)

\- **Abuse Density:** 0.0155 (very low)

\- **Subnet Classification:** Clean

\- **Total Siblings:** 193

\- **Active Siblings:** 46

\- **Threat Siblings:** 3 (6.5% of active peers)

\- **Risk Distribution:** 84 low-risk, 10 medium-risk, 0 high-risk

**Key Neighboring IPs:**

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 185.223.152.4 | 50 | 50 |

| 185.223.152.8 | 20 | 50 |

| 185.223.152.9 | 25 | 50 |

| 185.223.152.10 | 0 | 50 |

| 185.223.152.11 | 0 | 50 |

\## Observation History

**Total Observations:** 17 signals recorded on 2026-07-28

Recent activity includes:

\- Traceroute probes (13 hops, successful target reach)

\- Network role classification (firewalled/no services)

\- Geolocation validation (inconsistent RTT data)

\- Subnet abuse density assessment (clean classification)

No evidence of persistent malicious behavior or threat persistence detected.

\## Relationship Graph

\- **Primary Association:** IPXO network (185.223.152.0/23)

\- **Related Entities:** None beyond same-network classification

\## Recommended Security Actions

**Current Status:** No immediate action required

The IP presents as benign infrastructure with no active threat signals. Standard monitoring is appropriate. Consider the geolocation inconsistency when validating source claims, though this does not indicate malicious activity.

**Firewall Rules:** None generated (risk score below threshold)

\---

**Bottom Line:** IP 185.223.152.199 is a low-risk infrastructure address belonging to IPXO (netutils-mnt). The subnet demonstrates minimal abuse activity. Geolocation inconsistencies warrant awareness but do not indicate malicious operation. No blocking or filtering recommended at this time.

## Nearby addresses

- 185.223.152.4 (https://ipdebrief.com/185.223.152.4)
- 185.223.152.5 (https://ipdebrief.com/185.223.152.5)
- 185.223.152.6 (https://ipdebrief.com/185.223.152.6)
- 185.223.152.7 (https://ipdebrief.com/185.223.152.7)
- 185.223.152.8 (https://ipdebrief.com/185.223.152.8)
- 185.223.152.9 (https://ipdebrief.com/185.223.152.9)
- 185.223.152.10 (https://ipdebrief.com/185.223.152.10)
- 185.223.152.11 (https://ipdebrief.com/185.223.152.11)
- 185.223.152.12 (https://ipdebrief.com/185.223.152.12)
- 185.223.152.14 (https://ipdebrief.com/185.223.152.14)
- 185.223.152.15 (https://ipdebrief.com/185.223.152.15)
- 185.223.152.16 (https://ipdebrief.com/185.223.152.16)

---

Source: IPDebrief, "185.223.152.199 IP intelligence", https://ipdebrief.com/185.223.152.199, updated 2026-10-06. Assessments are probabilistic.