185.223.152.35📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 185.223.152.35/32

Classification: Low Risk

Report Date: Current

---

## EXECUTIVE SUMMARY

IP 185.223.152.35 presents a low-risk threat profile with a risk score of 25. The IP operates under the netutils-mnt organization within the IPXO network block (AS396356). Current analysis indicates minimal malicious activity with no open services, no known threat indicators, and a clean neighborhood classification. One minor DNSBL listing was observed.

---

## NETWORK OWNERSHIP & GEOGRAPHY

Organization: netutils-mnt (AS396356)

Network Name: IPXO

CIDR Block: 185.223.152.0/23

RIR Registry: RIPE

Abuse Contact: Available via RDAP

Geolocation:

• Primary: Boston, MA, US (America/New_York timezone)
• Secondary Signals: Los Angeles, CA, US
• GeoConsensus: Validated across 3 sources
• Accuracy: GeoPlausible status not confirmed

---

## THREAT ASSESSMENT

Risk Profile:

• Overall Risk Score: 25/100 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Abuse Confidence Score: Not applicable

Threat Indicators:

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Pulsedive Risk: Not applicable
• Known Campaigns: None detected

Control Plane Status:

• Route Stability: False
• Route Changes (30d): 0
• DNSSEC Valid: Yes
• Operator Score: 0.1304 (Minimal)
• DNSBL Listed: 1 of 8 total lists

---

## NETWORK ROLE & SERVICES

Service Classification: Firewalled / No Services

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Is Cloud/CDN/VPN/Proxy/Tor: No
• Is Hosting/Mobile/Residential: No

DNS Analysis:

• PTR Hostnames: None
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• Email Auth: No SPF/DMARC records
• TXT Record Count: 0

---

## NEIGHBORHOOD ANALYSIS

Subnet: 185.223.152.35/24

• Total Siblings: 187
• Active Siblings: 31
• Threat Siblings: 2
• Abuse Density: 1.07%
• Classification: Clean

Risk Distribution (Sample):

• High Risk: 0
• Medium Risk: 10
• Low Risk: 90

---

## OBSERVATION HISTORY

Total Observations: 15

Threat Persistence Days: 0

Is Persistently Malicious: No

Recent Signal Activity:

• Geolocation conflicts observed between Boston and Los Angeles sources
• One signal indicated "has_threats": true with 25 pulse names (confidence: 0.95)
• Multiple geolocation sources with confidence levels ranging from 0.30 to 0.95
• No ownership changes recorded

---

## RELATIONSHIPS

Detected: 2

• Both classified as "Same Network" relationship to network entity IPXO
• No connections to external organizations, hostnames, or certificates

---

## RECOMMENDED ACTIONS

Current Risk Posture: Minimal

Recommended Actions: None required at this time

Monitoring Considerations:

• Monitor for service openings (currently firewalled)
• Watch for geolocation consistency
• Track DNSBL listing status
• Monitor neighborhood for increased threat sibling activity

---

## SOC ANALYST NOTES

This IP represents a low-priority monitoring target. The low risk score (25), absence of active services, and minimal abuse density in the subnet indicate benign operation. The single DNSBL listing and historical threat signal warrant awareness but do not justify immediate blocking. Continue standard monitoring and update this assessment if service enumeration or threat indicators emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.