185.80.227.33📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Subject: 185.80.227.33/32

Classification: Moderate Risk (Score: 50/100)

Date: Current Analysis

Analyst: Automated Intelligence System

---

## EXECUTIVE SUMMARY

IP address 185.80.227.33 is a moderately risky host assigned to organization "Armand Gjini" (ASN 201249, AL-IPRO-20141211). The IP resides within the 185.80.224.0/22 block and is geolocated to New York, US, though ASN registration indicates Albanian ownership. No active services are detected on the host, and the immediate /24 subnet shows zero abuse density. The IP is currently listed on 2 of 8 DNSBLs with high-severity classifications.

---

## PROFILE ANALYSIS

Ownership & Registration:

• ASN: 201249 (IPRO - IPRO Sh.p.k., AL)
• Organization: Armand Gjini
• Netname: AL-IPRO-20141211
• RIR: RIPE
• Registration Date: 2014-12-11
• CIDR Block: 185.80.224.0/22

Geolocation:

• Country: US (US-NY, New York)
• Timezone: America/New_York
• Geo-plausibility: Valid
• Note: Geographic discrepancy exists between ASN registration (AL) and reported geolocation (US)

Network Classification:

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• Cloud/VPS/CDN/Proxy/Tor: Negative across all categories
• Connection Type: Not residential, mobile, or hosting

---

## THREAT INTELLIGENCE

Risk Assessment:

• Overall Risk Score: 50 (Moderate)
• Threat Indicators: None detected
• Known Campaigns: None
• Reputation Sources: Empty
• Abuse Confidence Score: Not available

Blacklist Status:

• Total DNSBL Listings: 8
• Active Listings: 2
• Maximum Severity: High
• Specific Lists: Multiple sources (exact list data omitted for security)

Control Plane Analysis:

• BGP Prefix: 185.80.227.0/24
• Route Stability: False
• RPKI State: Not available
• IRR Consistency: Not available
• DNSSEC Valid: Yes
• Route Changes (30d): 0

---

## NEIGHBORHOOD ANALYSIS

Subnet: 185.80.227.0/24

• Abuse Density: 0 (Clean)
• Classification: Clean
• Total Siblings: 5
• Active Siblings: 0
• Threat Siblings: 0

Sibling IP Risk Distribution:

Only one sibling (185.80.227.32) shows elevated risk (25), while the remaining three are clean. The /24 subnet demonstrates low overall abuse density.

---

## OBSERVATION HISTORY

Total Observations: 14 signals recorded

Recent Signal Timeline (Most Recent First):

1. 2026-07-27 00:50:57 — Subnet classified as "clean" with 0 abuse density

2. 2026-07-27 00:49:55 — Ownership stability confirmed (0 changes)

3. 2026-07-27 00:49:17 — DNSBL listings detected (2/8, high severity)

4. 2026-07-27 00:49:15 — DNSSEC validation confirmed; ASN attribution to AL registry

Temporal Trends:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: No
• Threat Observation Count: 0

---

## RELATIONSHIP MAPPING

The IP shares network relationships with the following entities:

• Network: AL-IPRO-20141211 (multiple same-network relationships detected)
• No hostname, organization, or certificate relationships detected
• No correlated IPs in campaign data

---

## RECOMMENDED ACTIONS

Immediate Mitigation:

1. Firewall Blocking:

```

iptables -A INPUT -s 185.80.227.33 -j DROP

nft add rule inet filter input ip saddr 185.80.227.33 drop

nginx: deny 185.80.227.33;

```

2. WAF Integration:

- Cloudflare: Block IP with expression `ip.src eq 185.80.227.33`

- AWS WAF: Add to address set `185.80.227.33/32`

- pfSense: Configure block rule for `185.80.227.33/32`

Monitoring Recommendations:

• Monitor for service activation on previously firewalled ports
• Track DNSBL listing changes (currently 2/8 lists)
• Watch for geographic location updates (US vs AL discrepancy)
• Correlate with subnet 185.80.227.0/24 for lateral activity

---

## RISK CONCLUSION

This IP represents a moderate-threat profile suitable for defensive blocking. The lack of active services, clean neighborhood classification, and absence of known malicious campaigns suggest limited immediate operational risk. However, the DNSBL listings (2/8, high severity) and route instability warrant continued monitoring. SOC teams should implement blocking controls while maintaining visibility into this address range.

Status: ACTIONABLE — Recommend blocking with monitoring

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.