185.80.227.75📋 Copy

# IP Intelligence Briefing: 185.80.227.75/32

## Executive Summary

IP 185.80.227.75 presents a moderate risk profile (Risk Score: 40) with no active threat indicators. The address is assigned to organization "Armand Gjini" under network block AL-IPRO-20141211 (ASN 201249) and registered with RIPE NCC in December 2014. The IP shows no current abuse activity, though it is listed on 2 of 8 DNSBLs.

## Ownership and Attribution

• Organization: Armand Gjini
• Network Name: AL-IPRO-20141211
• ASN: 201249 (IPRO - IPRO Sh.p.k., AL)
• CIDR Block: 185.80.224.0/22
• Registration Date: 2014-12-11
• RIR: RIPE NCC
• Abuse Contact: Available via RDAP

## Geolocation

• Country: United States (US)
• Region: New York (US-NY)
• Geolocation Consensus: Confirmed across 1 source
• Note: Geolocation appears inconsistent with ASN origin (Albania), which may indicate hosting infrastructure or misconfiguration.

## Network Services and DNS

• Open Ports: None detected
• DNS: No PTR hostnames, no forward resolution
• HTTP Services: No active HTTP endpoints
• Network Role: Firewalled / No Services

## Threat Intelligence

• Risk Score: 40 (Moderate)
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Max Severity: High
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None identified

## Neighborhood Analysis

Subnet 185.80.227.0/24 shows:

• Abuse Density: 0 (clean)
• Active Siblings: 3 of 6 total
• Threat Siblings: 0
• Risk Distribution: 0 high, 3 medium, 1 low
• Neighbor Risk Scores: Range from 25-55

Key neighbors include 185.80.227.18 (Risk: 55), 185.80.227.33 (Risk: 50), and 185.80.227.6 (Risk: 40).

## Historical Observations

Fourteen observations recorded. Recent activity includes:

• DNSSEC validation confirmed
• ASN 201249 consistently reported
• DNSBL listings with high severity noted in recent observations
• No persistent malicious behavior detected

## Recommended Security Actions

Based on risk profile, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 185.80.227.75 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 185.80.227.75 drop

```

Cloudflare WAF:

```

ip.src eq 185.80.227.75

```

AWS WAF:

```

Addresses: ["185.80.227.75/32"]

```

## Intelligence Assessment

This IP address represents low-to-moderate risk infrastructure with no active malicious indicators. The moderate risk score (40) is primarily driven by historical DNSBL listings. No evidence of current abuse, scanning, or exploitation activity. The subnet shows clean neighborhood characteristics with no threat siblings.

Priority: Monitor / Low

Recommended Action: Implement defensive filtering as indicated by firewall rules above. Continue monitoring for changes in DNSBL status or new threat indicators.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.