185.223.152.96📋 Copy

# IP Intelligence Briefing: 185.223.152.96/32

Classification: Moderate Risk | Report Date: Current Analysis

## Executive Summary

IP 185.223.152.96 is classified as Moderate Risk (Score: 50) with no active threat indicators. The address belongs to ASN 396356 (netutils-mnt, IPXO) and resides within the 185.223.152.0/23 CIDR block registered with RIPE. No open ports or services were detected, and the IP is not associated with known malicious campaigns.

## Network Ownership & Classification

• ASN: 396356 (netutils-mnt / IPXO)
• CIDR Block: 185.223.152.0/23
• RIR: RIPE
• Abuse Contact: Available via RDAP
• Network Role: Provider infrastructure, Firewalled / No Services

## Geolocation Analysis

Geolocation data shows conflicting signals:

• Registered Location: GB (Great Britain)
• Inferred Location: US-MA (Boston), with 750km accuracy radius
• Violation Detected: RTT 77ms < minimum possible 180.3ms for 9,014km distance

The significant geolocation discrepancy indicates unreliable location data. No definitive country attribution can be made with confidence.

## Neighborhood Assessment

The /24 subnet (185.223.152.0/24) contains 198 total sibling IPs:

• Active Siblings: 116
• Threat Siblings: 8 (4.1% threat density)
• Risk Distribution: 0 high-risk, 17 medium-risk, 83 low-risk
• Subnet Classification: Clean
• Abuse Density: 0.0404 (4.04%)

Eight sibling IPs within the /24 subnet show threat indicators, indicating some level of subnet-level activity.

## Threat Indicators

• Blacklist Status: 0 blacklists | 2 DNSBL listings (of 8 total)
• Tor/VPN/Proxy: Not detected
• Campaign Associations: None identified
• Known Attacker: No
• Spam Source: No

## Observations & History

14 signal observations recorded. Recent telemetry indicates:

• Network classification stable as "clean"
• Zero ownership changes observed
• No persistent malicious behavior detected
• Threat observation count: 0
• Not flagged as persistently malicious

## Security Actions

No immediate blocking recommended based on current risk profile. Monitor for service activation or risk score increases.

## Analyst Notes

1. Geolocation Reliability: Low confidence due to RTT distance violations

2. Subnet Context: 8 threat siblings in /24 warrants monitoring of adjacent addresses

3. Risk Profile: Moderate score driven by subnet-level indicators, not IP-specific threats

4. Action Threshold: IP should be allowed traffic unless outbound connections indicate suspicious behavior

---

*Data generated from IPDebrief intelligence platform. Analysis based on live signal collection and historical observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.