# 185.223.152.35 — IP Intelligence Summary 185.223.152.35 is an IPv4 address operated by netutils-mnt (AS396356), geolocated to Boston, United States. As of September 2, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/185.223.152.35 - Last updated: 2026-09-02 ## Ownership - Organization: netutils-mnt - Network name: IPXO - Allocated block: 185.223.152.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: RIPE ## Location - City: Boston - Region: US-MA - Country: United States - Time zone: America/New_York ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP INTELLIGENCE BRIEFING **Target:** 185.223.152.35/32 **Classification:** Low Risk **Report Date:** Current \--- \## EXECUTIVE SUMMARY IP 185.223.152.35 presents a low-risk threat profile with a risk score of 25. The IP operates under the netutils-mnt organization within the IPXO network block (AS396356). Current analysis indicates minimal malicious activity with no open services, no known threat indicators, and a clean neighborhood classification. One minor DNSBL listing was observed. \--- \## NETWORK OWNERSHIP & GEOGRAPHY **Organization:** netutils-mnt (AS396356) **Network Name:** IPXO **CIDR Block:** 185.223.152.0/23 **RIR Registry:** RIPE **Abuse Contact:** Available via RDAP **Geolocation:** \- Primary: Boston, MA, US (America/New_York timezone) \- Secondary Signals: Los Angeles, CA, US \- GeoConsensus: Validated across 3 sources \- Accuracy: GeoPlausible status not confirmed \--- \## THREAT ASSESSMENT **Risk Profile:** \- Overall Risk Score: 25/100 (Low Risk) \- Provider Score: 0 \- Authority Score: 0 \- Stability Score: 0 \- Abuse Confidence Score: Not applicable **Threat Indicators:** \- Known Attacker: No \- Spam Source: No \- Tor Exit Node: No \- Blacklist Count: 0 \- Pulsedive Risk: Not applicable \- Known Campaigns: None detected **Control Plane Status:** \- Route Stability: False \- Route Changes (30d): 0 \- DNSSEC Valid: Yes \- Operator Score: 0.1304 (Minimal) \- DNSBL Listed: 1 of 8 total lists \--- \## NETWORK ROLE & SERVICES **Service Classification:** Firewalled / No Services \- Open Ports: None detected \- TLS Certificate: None \- HTTP Banner: None \- Is Cloud/CDN/VPN/Proxy/Tor: No \- Is Hosting/Mobile/Residential: No **DNS Analysis:** \- PTR Hostnames: None \- Forward Resolution: Not confirmed \- Hosted Domains: 0 \- Email Auth: No SPF/DMARC records \- TXT Record Count: 0 \--- \## NEIGHBORHOOD ANALYSIS **Subnet:** 185.223.152.35/24 \- Total Siblings: 187 \- Active Siblings: 31 \- Threat Siblings: 2 \- Abuse Density: 1.07% \- Classification: Clean **Risk Distribution (Sample):** \- High Risk: 0 \- Medium Risk: 10 \- Low Risk: 90 \--- \## OBSERVATION HISTORY **Total Observations:** 15 **Threat Persistence Days:** 0 **Is Persistently Malicious:** No **Recent Signal Activity:** \- Geolocation conflicts observed between Boston and Los Angeles sources \- One signal indicated "has_threats": true with 25 pulse names (confidence: 0.95) \- Multiple geolocation sources with confidence levels ranging from 0.30 to 0.95 \- No ownership changes recorded \--- \## RELATIONSHIPS **Detected:** 2 \- Both classified as "Same Network" relationship to network entity IPXO \- No connections to external organizations, hostnames, or certificates \--- \## RECOMMENDED ACTIONS **Current Risk Posture:** Minimal **Recommended Actions:** None required at this time **Monitoring Considerations:** \- Monitor for service openings (currently firewalled) \- Watch for geolocation consistency \- Track DNSBL listing status \- Monitor neighborhood for increased threat sibling activity \--- \## SOC ANALYST NOTES This IP represents a low-priority monitoring target. The low risk score (25), absence of active services, and minimal abuse density in the subnet indicate benign operation. The single DNSBL listing and historical threat signal warrant awareness but do not justify immediate blocking. Continue standard monitoring and update this assessment if service enumeration or threat indicators emerge. ## Nearby addresses - 185.223.152.4 (https://ipdebrief.com/185.223.152.4) - 185.223.152.5 (https://ipdebrief.com/185.223.152.5) - 185.223.152.6 (https://ipdebrief.com/185.223.152.6) - 185.223.152.7 (https://ipdebrief.com/185.223.152.7) - 185.223.152.8 (https://ipdebrief.com/185.223.152.8) - 185.223.152.9 (https://ipdebrief.com/185.223.152.9) - 185.223.152.10 (https://ipdebrief.com/185.223.152.10) - 185.223.152.11 (https://ipdebrief.com/185.223.152.11) - 185.223.152.12 (https://ipdebrief.com/185.223.152.12) - 185.223.152.14 (https://ipdebrief.com/185.223.152.14) - 185.223.152.15 (https://ipdebrief.com/185.223.152.15) - 185.223.152.16 (https://ipdebrief.com/185.223.152.16) --- Source: IPDebrief, "185.223.152.35 IP intelligence", https://ipdebrief.com/185.223.152.35, updated 2026-09-02. Assessments are probabilistic.