185.223.235.25
Threat Intelligence Briefing: IP 185.223.235.25/32
Summary:
The IP address 185.223.235.25/32 is classified as High Risk with an overall risk score of 80. It is owned by HYDRA-MNT (RIPE), registered to a Netherlands-based entity in Amsterdam. Geolocation data confirms its physical location in Amsterdam, North Holland, Netherlands.
Key Findings:
1. Network Profile:
- Firewalled/No Services: No open ports or services detected.
- Subnet: Part of 185.223.235.0/24, with a subnet abuse density of 28.57% (mixed classification).
- Neighbors: 7 sibling IPs in the subnet, including 2 with elevated risk scores (65 and 55).
2. DNS & Ownership:
- Resolves to 185-223-235-25.infrawat.ch.
- DNSSEC validation is enabled, but no TLS certificates or HTTP services were detected.
- SPF and DMARC records are present, indicating basic email security configuration.
3. Threat Indicators:
- No direct malicious indicators (e.g., malware, phishing, or known attacker associations).
- DNSBL Listings: 4 out of 8 DNSBL lists.
- BGP Analysis: Route stability is flagged as unstable, with no recent changes.
4. Historical Observations (Last 30 Days):
- First observed on June 2, 2026, with no persistent malicious activity.
- Subnet abuse density and risk scores remain stable.
Recommendations:
- Monitor Subnet: Track neighboring IPs (e.g., 185.223.235.17, 185.223.235.44) with higher risk scores for anomalies.
- DNS Validation: Verify the legitimacy of infrawat.ch and ensure DNSSEC alignment with organizational policies.
- Firewall Rules: Consider blocking the subnet 185.223.235.0/24 if untrusted, given the mixed abuse density.
- Continuous Monitoring: Reassess the IP’s risk profile periodically, as no active threats were detected but DNSBL listings persist.
Conclusion:
While no direct malicious activity is observed, the IP’s high risk score and subnet’s moderate abuse density warrant further investigation. Focus on DNS integrity and subnet-level monitoring to mitigate potential risks.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | HYDRA-MNT |
| ASN | AS25369 |
| Network Name | — |
| CIDR Block | — |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 185-223-235-25.infrawat.ch |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 185-223-235-25.infrawat.ch |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 38% | 2 | 4 |
| routing | 47% | 1 | 8 |
| services | 15% | 2 | 2 |
| ownership | 24% | 2 | 3 |
| reputation | 32% | 1 | 3 |
| geolocation | 30% | 2 | 3 |
| Overall | 31% | 10 | 23 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:01 UTC |
| Last Seen | 2026-06-23 01:00:11 UTC |
| Profile Built | 2026-06-23 01:19:00 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 30 |
Full dossier details are available via our API.