2.229.200.226
# IP Intelligence Briefing: 2.229.200.226/32
## Executive Summary
IP address 2.229.200.226 is a high-risk (80/100) endpoint located in Milan, Italy, associated with FASTWEB telecommunications infrastructure. While no direct threat indicators were identified, the elevated risk score warrants defensive monitoring and review of recent traffic patterns.
## Technical Profile
- Risk Score: 80/100 (High Risk)
- Organization: FASTWEB-MNT (ASN 12874)
- Network: FASTWEB-L3-PAT_NAT (2.229.200.0/24)
- Geolocation: Milano MI, Lombardy, Italy (RIPE)
- Service Classification: Firewalled / No Services
- DNS Resolution: 2-229-200-226.ip198.fastwebnet.it (forward confirmed)
## Threat Indicators
No direct malicious indicators were detected:
- Not classified as known attacker, spam source, or Tor exit node
- Zero known campaign associations
- No active threat feed matches
- DNSBL: 4 out of 8 lists (limited impact)
- No open ports or service banners detected
## Network Context
- Control Plane: Origin ASN 12874, BGP prefix 2.224.0.0/13
- Routing: AS Path 3303 → 12874
- Operator Score: 0.3478 (Basic classification)
- Network Stability: Route changes observed (1 in 30 days)
- Subnet Analysis: No neighboring IPs detected in /24; zero abuse density
## Historical Observations
19 observation signals recorded, primarily from July 22, 2026. Recent signals confirm:
- Organization/AS assignment (confidence 0.90-0.95)
- Geolocation validation (confidence 0.30)
- Threat indicator checks (confidence 0.20-0.30)
## Recommended Actions
Immediate: Increase logging verbosity and review recent activity from this IP (Critical severity due to elevated risk score).
Firewall Rules:
- iptables: `iptables -A INPUT -s 2.229.200.226 -j DROP`
- nftables: `nft add rule inet filter input ip saddr 2.229.200.226 drop`
- nginx: `deny 2.229.200.226;`
- Cloudflare WAF: Block with expression `ip.src eq 2.229.200.226`
- AWS WAF: Add 2.229.200.226/32 to web ACL
## Analysis Notes
Despite the high risk classification, this IP represents legitimate FASTWEB infrastructure in Italy with no evidence of active malicious behavior. The risk score elevation may stem from network-level factors or routing anomalies rather than direct compromise. However, the 80/100 risk score triggers defensive protocol. Consider correlating with internal threat intelligence before implementing blocking measures, as the IP is part of a legitimate carrier network with proper SPF/DMARC configuration.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | FASTWEB-MNT |
| ASN | AS12874 |
| Network Name | FASTWEB-L3-PAT_NAT |
| CIDR Block | 2.229.200.0/24 |
| RIR | RIPE |
| Country | IT |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 2-229-200-226.ip198.fastwebnet.it |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 2-229-200-226.ip198.fastwebnet.it |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 443 | https | tcp | — |
| 8080 | http-alt | tcp | — |
| Closed Ports | 22, 25, 80, 3389, 8443 (2 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
E=sales@fulgosi.it, CN=scorza, O=Fulgosi srl, L=Via Volterra 6 - 20146 Milano, S=Italy, C=IT was found on this IP. This may indicate a previously hosted website, a decommissioned service, or stale infrastructure.| SANs | None |
| Valid From | 2018-12-22T16:16:30+00:00 |
| Valid Until | 2019-12-22T16:16:30+00:00 (expired) |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 365 days |
🛡️ Public Network Snapshot
| Origin ASN | AS12874 |
| Network Prefix | 2.224.0.0/13 |
| Route mapping | Found |
| HSTS | Not detected |
| CSP | Not detected |
| HTTP/2 | Not detected |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 17% | 1 | 1 |
| routing | 45% | 2 | 3 |
| services | 17% | 1 | 1 |
| ownership | 25% | 1 | 1 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 17% | 5 | 6 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-02 04:21:33 UTC |
| Last Seen | 2026-08-25 00:48:09 UTC |
| Profile Built | 2026-08-29 09:18:50 UTC |
| Data Freshness | Live |
| Signal Types | 28 |
| Total Observations | 29 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 2.229.200.226
Who owns the IP address 2.229.200.226?
2.229.200.226 is registered to FASTWEB-MNT. The address falls within the 2.229.200.0/24 network block. Registration is held at RIPE.
Where is 2.229.200.226 located?
Geolocation data places 2.229.200.226 in Milan, Lombardy, Italy. The local time zone is Europe/Rome. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 2.229.200.226 malicious or safe?
2.229.200.226 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 2.229.200.226?
The reverse DNS (PTR) record for 2.229.200.226 is 2-229-200-226.ip198.fastwebnet.it. This hostname is forward-confirmed, meaning it resolves back to the same address.
What ports are open on 2.229.200.226?
Responsive ports observed on 2.229.200.226 include 443, 8080. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.