185.227.152.135📋 Copy

# IP Intelligence Briefing: 185.227.152.135

## Executive Summary

IP address 185.227.152.135 presents a MODERATE RISK profile (Risk Score: 50) associated with the AXYCLOUD network infrastructure (ASN 55933, AXY Abuse Team). The IP is geolocated to South Korea with RIPE registration. No active threat indicators were detected, but the IP is classified with a service purpose of "Firewalled / No Services" and shows route instability.

## Network Ownership & Classification

• ASN: 55933 (AXY Abuse Team)
• Organization: AXYCLOUD
• CIDR Block: 185.227.152.0/23
• RIR: RIPE
• Network Role: Infrastructure (Firewalled / No Services)
• Cloud/Hosting Status: Not classified as cloud, CDN, VPN, proxy, Tor, or hosting provider

## Geolocation Data

• Country: South Korea (KR)
• Coordinates: 35.91°N, 127.77°E
• Timezone: Asia/Seoul
• Geographic Consensus: Mixed (some historical signals indicated Hong Kong)
• Geo Validation: Inconsistent (geoPlausible: false)

## Threat Intelligence Assessment

• Reputation: Moderate Risk (Score: 50)
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not available
• Known Campaigns: None identified

## Network Behavior & Services

• Open Ports: None detected
• DNS Resolution: No PTR records, no forward resolution
• Email Authentication: No SPF or DMARC records
• Route Stability: False
• BGP Prefix: 185.227.152.0/23
• Traceroute: 18 hops (first hop RTT: 0.2ms, last hop RTT: 393.5ms)

## Neighborhood Analysis

• Subnet: 185.227.152.135/24
• Abuse Density: 0 (no abuse detected in subnet)
• Neighbor Count: 0
• Threat Siblings: 0

## Historical Observation Trends

Analysis of 14 observations indicates:

• Recent classification: "clean"
• Organization consistently identified as AXY Abuse Team
• Geographic signals show inconsistency (South Korea vs Hong Kong)
• No evidence of persistent malicious activity (threatPersistenceDays: 0)

## Relationship Graph

• Primary Relationship: Same Network → AXYCLOUD
• No additional entity relationships detected

## Recommended Defensive Actions

Immediate Mitigation

```bash

# iptables

iptables -A INPUT -s 185.227.152.135 -j DROP

# nftables

nft add rule inet filter input ip saddr 185.227.152.135 drop

# nginx

deny 185.227.152.135;

# pfSense

185.227.152.135/32

# Cloudflare WAF

{"description":"Block 185.227.152.135 — IPDebrief risk score 50","action":"block","filter":{"expression":"ip.src eq 185.227.152.135"}}

# AWS WAF

{"Addresses":["185.227.152.135/32"],"Description":"IPDebrief risk 50"}

```

## Risk Assessment Summary

This IP address presents a moderate defensive concern primarily due to its association with an abuse team infrastructure and presence on DNSBLs. However, the absence of active threat indicators, Tor exit status, or known attacker classification suggests limited immediate threat. The route instability and geographic data inconsistencies warrant monitoring. Consider blocking at perimeter firewall while maintaining observation for emerging threat indicators.

---

*Report generated based on IPDebrief intelligence data. Recommendations should be validated against local security policies and combined with additional threat intelligence sources.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.