# 185.223.152.9 — IP Intelligence Summary

185.223.152.9 is an IPv4 address operated by netutils-mnt (AS396356), geolocated to Boston, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/185.223.152.9
- Last updated: 2026-10-06

## Ownership

- Organization: netutils-mnt
- Network name: IPXO
- Allocated block: 185.223.152.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: RIPE

## Location

- City: Boston
- Region: US-MA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 185.223.152.9/32

**Classification:** LOW RISK / MONITOR

**Date:** 2026-07-27

**Prepared By:** IPDebrief Intelligence Team

\---

\## Executive Summary

IP 185.223.152.9 is classified as **Low Risk** with a risk score of 0. The address operates as a firewalled endpoint with no active services. While the current profile indicates minimal threat activity, the IP shows recent blacklist activity and exists within a subnet with elevated neighbor risk indicators. Continuous monitoring is recommended.

\---

\## Technical Profile

| Attribute | Value |

|-----------|-------|

| **Risk Score** | 0 (Low Risk) |

| **Reputation** | Low Risk |

| **ASN** | Not Assigned |

| **Organization** | netutils-mnt / IPXO |

| **CIDR Block** | 185.223.152.0/23 |

| **RIR** | RIPE |

| **Geolocation** | US-MA, Boston (Conflicting: ASN data indicates ES) |

| **Timezone** | America/New_York |

\---

\## Network Services & DNS

\- **Open Ports:** None detected

\- **DNS Resolution:** No PTR record available; forward resolution confirmed false

\- **DNSSEC:** Valid (observed in recent history)

\- **Email Authentication:** No SPF or DMARC records

\- **Service Purpose:** Firewalled / No Services

\---

\## Threat Indicators

\- **Blacklist Status:** 1 listing detected (high severity) as of 2026-07-27; total of 8 associated listings

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Campaign Correlation:** None identified

\- **Abuse Confidence Score:** Not available

\---

\## Neighborhood Analysis (185.223.152.0/24)

| Metric | Value |

|--------|-------|

| **Total Siblings** | 187 |

| **Active Siblings** | 31 |

| **Threat Siblings** | 2 |

| **Abuse Density** | 0.0107 |

| **Subnet Classification** | Clean |

| **Inherited Risk** | 0 |

**Notable Neighbor Activity:**

\- 185.223.152.4: Risk Score 50, Authority Score 50

\- 185.223.152.8: Risk Score 20, Authority Score 50

\- Remaining 184 siblings: Risk Score 0

\---

\## Historical Observations

Fourteen signal observations recorded. Recent activity includes:

\- **Network Role Classification:** Not CDN, Tor, VPN, proxy, cloud, hosting, mobile, or residential

\- **Blacklist Activity:** 1 listing with high severity severity flag

\- **ASN Attribution:** ASN 396356 (LATITUDE-SH - Latitude.sh, US) with country code ES allocation

\- **PTR Record:** Unresolved

\- **Observation Confidence:** 0.30–0.90 across signals

\---

\## Control Plane Assessment

\- **Route Stability:** Unstable

\- **Origin ASN:** Not available

\- **RPKI State:** Not available

\- **IRR Consistency:** Not available

\- **BGP Prefix:** Not available

\- **DNSBL Listed:** 0 / 0 total lists

\---

\## Recommended Actions

**No immediate blocking actions recommended** based on current risk profile. However, the following considerations apply:

1. **Monitor Blacklist Activity:** IP shows recent high-severity blacklist listing. Investigate source and context if traffic is observed.

2. **Subnet Awareness:** Two threat siblings exist within the /24. Apply contextual awareness to adjacent addresses.

3. **Geolocation Discrepancy:** Address shows US geolocation but ASN data indicates ES. Verify routing context if traffic patterns warrant investigation.

**Firewall Rules:** None generated (risk score 0, no active services)

\---

\## Conclusion

IP 185.223.152.9 presents minimal immediate threat risk but warrants continued monitoring due to:

\- Recent high-severity blacklist listing

\- Subnet neighborhood with elevated risk indicators

\- Geolocation attribution conflicts

Treat as **monitor-level threat** with no active blocking recommendations. Review neighborhood IPs if anomalous traffic patterns emerge from the 185.223.152.0/24 subnet.

## Nearby addresses

- 185.223.152.4 (https://ipdebrief.com/185.223.152.4)
- 185.223.152.5 (https://ipdebrief.com/185.223.152.5)
- 185.223.152.6 (https://ipdebrief.com/185.223.152.6)
- 185.223.152.7 (https://ipdebrief.com/185.223.152.7)
- 185.223.152.8 (https://ipdebrief.com/185.223.152.8)
- 185.223.152.10 (https://ipdebrief.com/185.223.152.10)
- 185.223.152.11 (https://ipdebrief.com/185.223.152.11)
- 185.223.152.12 (https://ipdebrief.com/185.223.152.12)
- 185.223.152.14 (https://ipdebrief.com/185.223.152.14)
- 185.223.152.15 (https://ipdebrief.com/185.223.152.15)
- 185.223.152.16 (https://ipdebrief.com/185.223.152.16)
- 185.223.152.17 (https://ipdebrief.com/185.223.152.17)

---

Source: IPDebrief, "185.223.152.9 IP intelligence", https://ipdebrief.com/185.223.152.9, updated 2026-10-06. Assessments are probabilistic.