185.223.152.203📋 Copy

# IPDebrief Intelligence Briefing: 185.223.152.203

Classification: LOW RISK / MONITOR

Date: Current

Analyst: Automated Intelligence System

---

## Executive Summary

IP address 185.223.152.203 is classified as LOW RISK with a risk score of 0. The address shows no active threat indicators, no blacklist entries, and no known malicious activity. No services are currently accessible on the IP, and it operates in a subnet with minimal abuse density.

## Network Ownership & Infrastructure

## Geolocation Analysis

Geolocation data shows inconsistencies across multiple sources:

• Primary Consensus: United States, Massachusetts, Boston
• Alternative Reports: United Kingdom (Mostoles), California
• Confidence Level: Mixed (0.70-0.95)
• Geo Source Count: 2

This discrepancy warrants monitoring but does not indicate active malicious activity.

## Threat Intelligence Indicators

• Threat Score: 0 (Low Risk)
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Associations: None detected

## Network Services & DNS

The IP is classified as "Firewalled / No Services" with no active services exposed.

## Subnet Context (185.223.152.0/24)

• Total Neighbors: 100 IPs
• Abuse Density: 0
• Risk Distribution: 84 Low Risk, 10 Medium Risk, 0 High Risk
• Threat Siblings: 0

The /24 subnet demonstrates minimal abuse activity with only 10 IPs flagged as medium risk.

## Historical Observation Timeline

Total Observations: 11 signals

Recent observations (July 2026) show:

• Geolocation signals from multiple sources
• Organization and ASN data from RIPE database
• Control plane signals showing DNSSEC validation

No escalating threat patterns detected in observation history.

## Control Plane Analysis

• BGP Prefix: 185.223.152.0/24
• Route Changes (30d): Active
• Route Stability: False
• DNSSEC: Valid
• DNSBL Listed: 0 of 8 lists
• Operator Score: 0.1304 (Minimal)

## Recommended Actions

Immediate Action Required: None

Monitoring Priority: Routine

The IP presents no immediate security concerns. Standard monitoring protocols are sufficient.

## SOC Analyst Notes

• IP is owned by IPXO network infrastructure
• No active services or open ports detected
• Geolocation inconsistencies are common for infrastructure IPs
• Subnet abuse density is negligible
• No firewall rules required at this time
• Continue standard IP reputation monitoring

---

Intelligence Confidence: HIGH

Data Sources: IPDebrief Core, RIPE, Control Plane, Historical Signals

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.