185.223.152.29📋 Copy

# Intelligence Briefing: 185.223.152.29/32

Classification: Low Risk | Date: 2026-07-27 | Analyst: IPDebrief Intelligence

## Executive Summary

IP 185.223.152.29 presents a low-risk profile with no active threat indicators. The address is registered to ASN 396356 (IPXO) under the netutils-mnt organization. While geolocation data shows some inconsistency between sources (Boston, MA and Los Angeles, CA), the IP demonstrates stable network behavior with zero observed malicious activity, no open services, and no blacklist presence. The /24 subnet exhibits minimal abuse density (0.0107) with 90% of sibling IPs classified as clean.

## Technical Profile

Network Ownership:

• ASN: 396356 (maxihost llc)
• Organization: netutils-mnt / IPXO
• RIR: RIPE
• CIDR Block: 185.223.152.0/23
• Registration: Active

Geolocation:

• Primary: US (MA, Boston)
• Alternative Sources: US (CA, Los Angeles)
• Timezone: America/New_York
• GeoConsensus: Partial (3 sources, mixed results)

Network Classification:

• Service Purpose: Firewalled / No Services
• Infrastructure: Not cloud, CDN, proxy, VPN, Tor, or hosting
• DNS Status: No PTR records, no forward resolution
• Email Auth: No SPF/DMARC records configured

## Threat Assessment

Current Risk Metrics:

• Risk Score: 0/100
• Abuse Confidence: N/A
• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: None

Behavioral Indicators:

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0
• Persistence Days: 0

Control Plane Analysis:

• BGP Prefix: 185.223.152.0/24
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC Valid: Yes
• DNSBL Listed: 0/8 lists
• Operator Score: 0.1304 (Minimal)

## Historical Activity

The IP has generated 15 signal observations. Recent activity (2026-07-27) shows:

• Multiple geolocation source conflicts (Boston vs Los Angeles)
• One source flagged with threat pulses (pulse_count: 3) but no confirmed attacks
• No ownership changes detected
• No persistent malicious behavior observed over the observation window

The inconsistency in geolocation data suggests either routing anomalies or multiple routing paths through different network providers.

## Neighborhood Analysis

Subnet: 185.223.152.0/24

• Total Siblings: 187
• Active Siblings: 31
• Abuse Density: 0.0107 (Low)
• Threat Siblings: 2

Risk Distribution:

• High Risk: 0 (0%)
• Medium Risk: 10 (10%)
• Low Risk: 90 (90%)

Notable Neighboring IPs:

• 185.223.152.4: Risk Score 50, Authority Score 50
• 185.223.152.8: Risk Score 20, Authority Score 50
• 185.223.152.9: Risk Score 25, Authority Score 50

The majority of the /24 subnet remains clean, with only 2 IPs flagged as threats. The target IP shows inherited risk of 0.

## Network Relationships

The IP maintains relationships with the IPXO network infrastructure. No external hostnames, organizations, or certificates were identified in the relationship graph.

## Recommended Actions

Firewall Rules: No blocking required. Monitor for service discovery.

Threat Hunting: No immediate action needed. IP exhibits benign characteristics.

Monitoring: Continue standard observation. The route instability flag warrants periodic review.

Rule Templates (None Required):

• No iptables/nftables rules needed
• No WAF rules required
• No DNS filtering actions necessary

## Conclusion

IP 185.223.152.29 is classified as low-risk with no actionable threat intelligence. The address operates as a firewalled endpoint with no exposed services. While geolocation data shows some inconsistency and the BGP route is marked as unstable, these do not indicate malicious activity. The subnet exhibits minimal abuse density and the target IP maintains zero incidents across all behavioral metrics.

Recommendation: Monitor at standard intervals. No immediate remediation or blocking required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.