# 185.223.152.29 — IP Intelligence Summary 185.223.152.29 is an IPv4 address operated by netutils-mnt (AS396356), geolocated to Boston, United States. As of August 29, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/185.223.152.29 - Last updated: 2026-08-29 ## Ownership - Organization: netutils-mnt - Network name: IPXO - Allocated block: 185.223.152.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: RIPE ## Location - City: Boston - Region: US-MA - Country: United States - Time zone: America/New_York ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# Intelligence Briefing: 185.223.152.29/32 **Classification:** Low Risk | **Date:** 2026-07-27 | **Analyst:** IPDebrief Intelligence \## Executive Summary IP 185.223.152.29 presents a low-risk profile with no active threat indicators. The address is registered to ASN 396356 (IPXO) under the netutils-mnt organization. While geolocation data shows some inconsistency between sources (Boston, MA and Los Angeles, CA), the IP demonstrates stable network behavior with zero observed malicious activity, no open services, and no blacklist presence. The /24 subnet exhibits minimal abuse density (0.0107) with 90% of sibling IPs classified as clean. \## Technical Profile **Network Ownership:** \- ASN: 396356 (maxihost llc) \- Organization: netutils-mnt / IPXO \- RIR: RIPE \- CIDR Block: 185.223.152.0/23 \- Registration: Active **Geolocation:** \- Primary: US (MA, Boston) \- Alternative Sources: US (CA, Los Angeles) \- Timezone: America/New_York \- GeoConsensus: Partial (3 sources, mixed results) **Network Classification:** \- Service Purpose: Firewalled / No Services \- Infrastructure: Not cloud, CDN, proxy, VPN, Tor, or hosting \- DNS Status: No PTR records, no forward resolution \- Email Auth: No SPF/DMARC records configured \## Threat Assessment **Current Risk Metrics:** \- Risk Score: 0/100 \- Abuse Confidence: N/A \- Blacklist Count: 0 \- Known Campaigns: None \- Threat Feeds: None **Behavioral Indicators:** \- Honeypot Hits: 0 \- Enumeration Strikes: 0 \- WAF Violations: 0 \- Total Incidents: 0 \- Persistence Days: 0 **Control Plane Analysis:** \- BGP Prefix: 185.223.152.0/24 \- Route Stability: Unstable (isRouteStable: false) \- DNSSEC Valid: Yes \- DNSBL Listed: 0/8 lists \- Operator Score: 0.1304 (Minimal) \## Historical Activity The IP has generated 15 signal observations. Recent activity (2026-07-27) shows: \- Multiple geolocation source conflicts (Boston vs Los Angeles) \- One source flagged with threat pulses (pulse_count: 3) but no confirmed attacks \- No ownership changes detected \- No persistent malicious behavior observed over the observation window The inconsistency in geolocation data suggests either routing anomalies or multiple routing paths through different network providers. \## Neighborhood Analysis **Subnet: 185.223.152.0/24** \- Total Siblings: 187 \- Active Siblings: 31 \- Abuse Density: 0.0107 (Low) \- Threat Siblings: 2 **Risk Distribution:** \- High Risk: 0 (0%) \- Medium Risk: 10 (10%) \- Low Risk: 90 (90%) **Notable Neighboring IPs:** \- 185.223.152.4: Risk Score 50, Authority Score 50 \- 185.223.152.8: Risk Score 20, Authority Score 50 \- 185.223.152.9: Risk Score 25, Authority Score 50 The majority of the /24 subnet remains clean, with only 2 IPs flagged as threats. The target IP shows inherited risk of 0. \## Network Relationships The IP maintains relationships with the IPXO network infrastructure. No external hostnames, organizations, or certificates were identified in the relationship graph. \## Recommended Actions **Firewall Rules:** No blocking required. Monitor for service discovery. **Threat Hunting:** No immediate action needed. IP exhibits benign characteristics. **Monitoring:** Continue standard observation. The route instability flag warrants periodic review. **Rule Templates (None Required):** \- No iptables/nftables rules needed \- No WAF rules required \- No DNS filtering actions necessary \## Conclusion IP 185.223.152.29 is classified as low-risk with no actionable threat intelligence. The address operates as a firewalled endpoint with no exposed services. While geolocation data shows some inconsistency and the BGP route is marked as unstable, these do not indicate malicious activity. The subnet exhibits minimal abuse density and the target IP maintains zero incidents across all behavioral metrics. **Recommendation:** Monitor at standard intervals. No immediate remediation or blocking required. ## Nearby addresses - 185.223.152.4 (https://ipdebrief.com/185.223.152.4) - 185.223.152.5 (https://ipdebrief.com/185.223.152.5) - 185.223.152.6 (https://ipdebrief.com/185.223.152.6) - 185.223.152.7 (https://ipdebrief.com/185.223.152.7) - 185.223.152.8 (https://ipdebrief.com/185.223.152.8) - 185.223.152.9 (https://ipdebrief.com/185.223.152.9) - 185.223.152.10 (https://ipdebrief.com/185.223.152.10) - 185.223.152.11 (https://ipdebrief.com/185.223.152.11) - 185.223.152.12 (https://ipdebrief.com/185.223.152.12) - 185.223.152.14 (https://ipdebrief.com/185.223.152.14) - 185.223.152.15 (https://ipdebrief.com/185.223.152.15) - 185.223.152.16 (https://ipdebrief.com/185.223.152.16) --- Source: IPDebrief, "185.223.152.29 IP intelligence", https://ipdebrief.com/185.223.152.29, updated 2026-08-29. Assessments are probabilistic.