# 185.223.152.89 — IP Intelligence Summary 185.223.152.89 is an IPv4 address operated by netutils-mnt (AS396356), geolocated to Los Angeles, Spain. As of September 4, 2026, IPDebrief rates it Moderate Risk (60/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/185.223.152.89 - Last updated: 2026-09-04 ## Ownership - Organization: netutils-mnt - Network name: IPXO - Allocated block: 185.223.152.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: RIPE ## Location - City: Los Angeles - Region: CA - Country: Spain - Time zone: Europe/Madrid ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (60/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 185.223.152.89/32 **Classification:** Moderate Risk | **Date of Analysis:** 2026-07-28 \## Executive Summary IP address 185.223.152.89 presents moderate risk (score: 60) with no active threat indicators. The address belongs to IPXO (ASN 396356, RIPE) and is currently firewalled with no open services. Neighborhood analysis indicates low abuse density (1.56%) within the /24 subnet. Recommended actions: monitor for service emergence and maintain defensive posture. \## Profile Overview \- **Risk Score:** 60 (Moderate Risk) \- **ASN:** 396356 (netutils-mnt) \- **Organization:** IPXO \- **CIDR Block:** 185.223.152.0/23 \- **RIR:** RIPE \- **Geolocation:** Spain (ES), Region: US-MA, City: Boston \- **Network Role:** Provider/Infrastructure (firewalled, no services) \## Threat Assessment \- **Threat Indicators:** None detected \- **Blacklist Count:** 0 \- **Tor Exit Node:** No \- **Known Attacker:** No \- **Spam Source:** No \- **Known Campaigns:** None \- **DNSBL Listed:** 1 of 8 total lists \- **Pulsedive Risk:** Not available \## Network Services \- **Open Ports:** None \- **TLS Certificate:** None \- **HTTP Title:** None \- **Server Banner:** None \- **Certificate Count:** 0 \## Control Plane Analysis \- **Origin ASN:** 396356 \- **BGP Prefix:** 185.223.152.0/24 \- **RPKI State:** Not available \- **Route Stability:** False \- **Route Changes (30d):** 0 \- **DNSSEC Valid:** Yes \- **MOAS:** No \- **Operator Score:** 0.1304 (Minimal) \## Neighborhood Analysis \- **Subnet:** 185.223.152.89/24 \- **Abuse Density:** 0.0156 (1.56%) \- **Classification:** Clean \- **Total Siblings:** 192 \- **Active Siblings:** 44 \- **Threat Siblings:** 3 \- **Risk Distribution:** High: 0, Medium: 9, Low: 86 Notable neighbors include: \- 185.223.152.4 (Risk: 50, Authority: 50) \- 185.223.152.8 (Risk: 20, Authority: 50) \- 185.223.152.9 (Risk: 25, Authority: 50) \## Relationship Graph \- **Same Network:** IPXO (3 relationships) \- **External Relationships:** None detected (no associated hostnames, organizations, or certificates beyond network classification) \## Observation History \- **Total Observations:** 18 \- **Ownership Changes:** 0 \- **Threat Persistence:** 0 days \- **Is Persistently Malicious:** No \- **Recent Signals:** \- Subnet classification: Clean \- Ownership: Stable (netutils-mnt) \- Geolocation: Spain \- Network classification: Provider/Infrastructure \## Geo Validation \- **Plausibility:** False \- **Distance:** 9,013.9 km \- **Min RTT:** 75ms \- **Avg RTT:** 77.8ms \- **Violation:** RTT 75.0ms \< minimum possible 180.3ms for 9014km \- **Probe Count:** 5 \## Traceroute \- **Hop Count:** 13 \- **First Hop RTT:** 0.2ms \- **Last Hop RTT:** 85.3ms \- **Timed Out Hops:** 2 \- **Transit Networks:** Comcast, GTT \## Behavioral Indicators \- **Honeypot Hits:** 1 \- **Enumera\[...\]:** Trimmed from response \## Recommended Actions \- **Block:** Not recommended (moderate risk, no active threats) \- **Monitor:** Track for service emergence \- **Firewall Rules:** Standard monitoring appropriate \- **WAF Rules:** No specific rules required \## Intelligence Narrative The IP 185.223.152.89 is associated with IPXO (ASN 396356), a RIPE-regulated network. The address has a moderate risk score of 60 driven by DNSBL listing rather than active threat indicators. Currently firewalled with no open services, the IP presents minimal immediate threat. The /24 neighborhood shows 1.56% abuse density with 3 threat siblings out of 44 active addresses, suggesting the broader network segment is relatively clean. Geo location validation shows discrepancy between reported Spain location and RTT measurements, indicating potential geolocation data inaccuracy. No persistent malicious behavior detected across 18 observations. Recommend continued monitoring for service emergence and maintain baseline defensive posture. ## Nearby addresses - 185.223.152.4 (https://ipdebrief.com/185.223.152.4) - 185.223.152.5 (https://ipdebrief.com/185.223.152.5) - 185.223.152.6 (https://ipdebrief.com/185.223.152.6) - 185.223.152.7 (https://ipdebrief.com/185.223.152.7) - 185.223.152.8 (https://ipdebrief.com/185.223.152.8) - 185.223.152.9 (https://ipdebrief.com/185.223.152.9) - 185.223.152.10 (https://ipdebrief.com/185.223.152.10) - 185.223.152.11 (https://ipdebrief.com/185.223.152.11) - 185.223.152.12 (https://ipdebrief.com/185.223.152.12) - 185.223.152.14 (https://ipdebrief.com/185.223.152.14) - 185.223.152.15 (https://ipdebrief.com/185.223.152.15) - 185.223.152.16 (https://ipdebrief.com/185.223.152.16) --- Source: IPDebrief, "185.223.152.89 IP intelligence", https://ipdebrief.com/185.223.152.89, updated 2026-09-04. Assessments are probabilistic.