185.97.117.225📋 Copy

# IP Intelligence Briefing: 185.97.117.225

## Executive Summary

IP address 185.97.117.225 is a low-risk infrastructure address operated by AbrArvan (ASN 202468) from Iran. The IP shows minimal threat indicators, no open services, and limited subnet abuse density. Current risk assessment indicates defensive monitoring is appropriate without immediate blocking.

## Ownership and Network Classification

• Organization: AbrArvan (ASN 202468)
• CIDR Block: 185.97.117.0/24
• RIR: RIPE
• Country: Iran (IR)
• Network Role: Firewalled / No Services Detected
• Infrastructure Type: Not classified as CDN, cloud, VPN, proxy, or hosting provider

## Risk Assessment

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable (no active threats)
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Operator Score: 0.1304 (Minimal)
• Known Campaigns: None detected
• Tor/Proxy/VPN: Negative

## Service and Port Analysis

• Open Ports: None detected
• DNS Records: No PTR hostnames; forward resolution inactive
• Email Authentication: No SPF/DMARC records configured
• HTTP Services: No TLS certificates or HTTP banners detected
• Connection Status: No active services responding

## Historical Observations (13 Total)

Most recent signals from 2026-07-22 indicate:

• Subnet classified as "clean" with 0 abuse density
• Consistent geolocation to Iran (IR)
• No ownership changes or persistent malicious activity
• No threat observation count recorded
• Stability indicators show no persistent threat behavior

## Network Neighborhood Analysis

• Subnet: 185.97.117.0/24
• Abuse Density: 0
• Neighbor Count: 1 active sibling
• Neighbor IP: 185.97.117.165 (Risk Score: 0, Authority Score: 50)
• Threat Siblings: 0
• Overall Classification: Low risk neighborhood

## Relationship Graph

• Connected Entities: 1
• Primary Relationship: Same network (AbrArvan_185_97_117_0_24)
• No external organizational or certificate relationships detected

## Control Plane and Routing

• BGP Prefix: 185.97.116.0/22
• Route Stability: False
• Route Changes (30d): 0
• RPKI State: Not evaluated
• DNSSEC: Valid

## Recommended Actions

Based on current risk profile (25/100), standard defensive posture recommended:

1. Monitor: Maintain passive observation and logging

2. Rate Limiting: Apply standard rate limits for outbound/inbound traffic

3. DNSBL Verification: Confirm DNSBL listing status before action

4. No Immediate Block: No active threat indicators warrant immediate blocking

5. Periodic Reassessment: Review quarterly or upon threat indicator emergence

## Intelligence Notes

The IP address exhibits characteristics of a static, firewalled infrastructure endpoint with no active services. The single DNSBL listing requires context investigation but does not indicate active malicious behavior. The subnet demonstrates minimal abuse density, suggesting legitimate operational use. Continue standard monitoring protocols without escalation.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.