185.223.152.9📋 Copy

# IP Intelligence Briefing: 185.223.152.9/32

Classification: LOW RISK / MONITOR

Date: 2026-07-27

Prepared By: IPDebrief Intelligence Team

---

## Executive Summary

IP 185.223.152.9 is classified as Low Risk with a risk score of 0. The address operates as a firewalled endpoint with no active services. While the current profile indicates minimal threat activity, the IP shows recent blacklist activity and exists within a subnet with elevated neighbor risk indicators. Continuous monitoring is recommended.

---

## Technical Profile

---

## Network Services & DNS

• Open Ports: None detected
• DNS Resolution: No PTR record available; forward resolution confirmed false
• DNSSEC: Valid (observed in recent history)
• Email Authentication: No SPF or DMARC records
• Service Purpose: Firewalled / No Services

---

## Threat Indicators

• Blacklist Status: 1 listing detected (high severity) as of 2026-07-27; total of 8 associated listings
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: None identified
• Abuse Confidence Score: Not available

---

## Neighborhood Analysis (185.223.152.0/24)

Notable Neighbor Activity:

• 185.223.152.4: Risk Score 50, Authority Score 50
• 185.223.152.8: Risk Score 20, Authority Score 50
• Remaining 184 siblings: Risk Score 0

---

## Historical Observations

Fourteen signal observations recorded. Recent activity includes:

• Network Role Classification: Not CDN, Tor, VPN, proxy, cloud, hosting, mobile, or residential
• Blacklist Activity: 1 listing with high severity severity flag
• ASN Attribution: ASN 396356 (LATITUDE-SH - Latitude.sh, US) with country code ES allocation
• PTR Record: Unresolved
• Observation Confidence: 0.30–0.90 across signals

---

## Control Plane Assessment

• Route Stability: Unstable
• Origin ASN: Not available
• RPKI State: Not available
• IRR Consistency: Not available
• BGP Prefix: Not available
• DNSBL Listed: 0 / 0 total lists

---

## Recommended Actions

No immediate blocking actions recommended based on current risk profile. However, the following considerations apply:

1. Monitor Blacklist Activity: IP shows recent high-severity blacklist listing. Investigate source and context if traffic is observed.

2. Subnet Awareness: Two threat siblings exist within the /24. Apply contextual awareness to adjacent addresses.

3. Geolocation Discrepancy: Address shows US geolocation but ASN data indicates ES. Verify routing context if traffic patterns warrant investigation.

Firewall Rules: None generated (risk score 0, no active services)

---

## Conclusion

IP 185.223.152.9 presents minimal immediate threat risk but warrants continued monitoring due to:

• Recent high-severity blacklist listing
• Subnet neighborhood with elevated risk indicators
• Geolocation attribution conflicts

Treat as monitor-level threat with no active blocking recommendations. Review neighborhood IPs if anomalous traffic patterns emerge from the 185.223.152.0/24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.