185.223.152.89📋 Copy

# IP Intelligence Briefing: 185.223.152.89/32

Classification: Moderate Risk | Date of Analysis: 2026-07-28

## Executive Summary

IP address 185.223.152.89 presents moderate risk (score: 60) with no active threat indicators. The address belongs to IPXO (ASN 396356, RIPE) and is currently firewalled with no open services. Neighborhood analysis indicates low abuse density (1.56%) within the /24 subnet. Recommended actions: monitor for service emergence and maintain defensive posture.

## Profile Overview

• Risk Score: 60 (Moderate Risk)
• ASN: 396356 (netutils-mnt)
• Organization: IPXO
• CIDR Block: 185.223.152.0/23
• RIR: RIPE
• Geolocation: Spain (ES), Region: US-MA, City: Boston
• Network Role: Provider/Infrastructure (firewalled, no services)

## Threat Assessment

• Threat Indicators: None detected
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None
• DNSBL Listed: 1 of 8 total lists
• Pulsedive Risk: Not available

## Network Services

• Open Ports: None
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None
• Certificate Count: 0

## Control Plane Analysis

• Origin ASN: 396356
• BGP Prefix: 185.223.152.0/24
• RPKI State: Not available
• Route Stability: False
• Route Changes (30d): 0
• DNSSEC Valid: Yes
• MOAS: No
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis

• Subnet: 185.223.152.89/24
• Abuse Density: 0.0156 (1.56%)
• Classification: Clean
• Total Siblings: 192
• Active Siblings: 44
• Threat Siblings: 3
• Risk Distribution: High: 0, Medium: 9, Low: 86

Notable neighbors include:

• 185.223.152.4 (Risk: 50, Authority: 50)
• 185.223.152.8 (Risk: 20, Authority: 50)
• 185.223.152.9 (Risk: 25, Authority: 50)

## Relationship Graph

• Same Network: IPXO (3 relationships)
• External Relationships: None detected (no associated hostnames, organizations, or certificates beyond network classification)

## Observation History

• Total Observations: 18
• Ownership Changes: 0
• Threat Persistence: 0 days
• Is Persistently Malicious: No
• Recent Signals:

- Subnet classification: Clean

- Ownership: Stable (netutils-mnt)

- Geolocation: Spain

- Network classification: Provider/Infrastructure

## Geo Validation

• Plausibility: False
• Distance: 9,013.9 km
• Min RTT: 75ms
• Avg RTT: 77.8ms
• Violation: RTT 75.0ms < minimum possible 180.3ms for 9014km
• Probe Count: 5

## Traceroute

• Hop Count: 13
• First Hop RTT: 0.2ms
• Last Hop RTT: 85.3ms
• Timed Out Hops: 2
• Transit Networks: Comcast, GTT

## Behavioral Indicators

• Honeypot Hits: 1
• Enumera[...]: Trimmed from response

## Recommended Actions

• Block: Not recommended (moderate risk, no active threats)
• Monitor: Track for service emergence
• Firewall Rules: Standard monitoring appropriate
• WAF Rules: No specific rules required

## Intelligence Narrative

The IP 185.223.152.89 is associated with IPXO (ASN 396356), a RIPE-regulated network. The address has a moderate risk score of 60 driven by DNSBL listing rather than active threat indicators. Currently firewalled with no open services, the IP presents minimal immediate threat. The /24 neighborhood shows 1.56% abuse density with 3 threat siblings out of 44 active addresses, suggesting the broader network segment is relatively clean. Geo location validation shows discrepancy between reported Spain location and RTT measurements, indicating potential geolocation data inaccuracy. No persistent malicious behavior detected across 18 observations. Recommend continued monitoring for service emergence and maintain baseline defensive posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.