2.27.54.13📋 Copy

# IP INTELLIGENCE BRIEFING: 2.27.54.13

## EXECUTIVE SUMMARY

IP 2.27.54.13 is assessed as MODERATE RISK (55/100). The address belongs to Xorek.Cloud Moscow (ASN 215590) within the 2.27.54.0/24 CIDR block. No active malicious indicators were detected, though the IP is listed on 3 of 8 DNSBLs. The IP hosts no active services and appears to be firewalled.

## OWNERSHIP AND GEOLOCATION

• Organization: Xorek.Cloud Moscow
• ASN: 215590 (RIPE)
• CIDR Block: 2.27.54.0/24
• Primary Country: US (geolocation consensus from 1 source)
• Additional Geolocation Signals: Some sources indicate Russian Federation (RU)
• Registration: Data not available via standard RIR queries

## THREAT INDICATORS

• Abuse Confidence Score: Not calculated
• Known Attacker: No
• Tor Exit Node: No
• Known Spam Source: No
• Blacklist Count: 3 (of 8 total DNSBLs)
• Known Campaigns: None detected
• Threat Persistence: 0 days
• Persistence Label: Not persistently malicious

## NETWORK CLASSIFICATION

• Infrastructure Type: Hosting
• Cloud Provider: No
• CDN: No
• VPN: No
• Proxy: No
• Tor Network: No
• Mobile/Residential: No
• Bogon Range: No
• Anycast: No
• Open Ports: None detected
• Services: Firewalled / No Services

## NETWORK NEIGHBORHOOD ANALYSIS

• Subnet: 2.27.54.0/24
• Total Siblings: 2 active neighbors identified
• Abuse Density: 0%
• Risk Distribution: 0 high-risk, 0 medium-risk, 2 low-risk neighbors
• Neighbor IPs:

- 2.27.54.62 (Risk Score: 25, Authority Score: 50)

- 2.27.54.133 (Risk Score: 25, Authority Score: 50)

## OBSERVATION HISTORY

• Total Observations: 14 signals recorded
• Most Recent Activity: 2026-07-30T02:08:15 UTC
• Signal Types: Traceroute, DNS resolution, network classification, geolocation
• Threat Observation Count: 0
• Ownership Changes: 0

## RELATIONSHIP GRAPH

• Total Relationships: 4
• Relationship Type: Same Network (xorekcloud-msk)
• Linked Entities: 4 instances of xorekcloud-msk network reference

## CONTROL PLANE DATA

• Origin ASN: 215590
• BGP Prefix: 2.27.54.0/24
• Route Stability: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• RPKI State: Not assessed
• IRR Consistency: Not assessed
• DNSSEC Valid: Yes
• DNSBL Listed Count: 3

## RECOMMENDED ACTIONS

Risk Score: 55/100 — Monitoring recommended

Primary Recommendation: Increase logging verbosity and review recent activity from this IP due to elevated risk score (55/100).

## ANALYSIS NOTES

This IP address shows moderate risk characteristics without active malicious indicators. The primary concern is the presence on multiple DNSBLs combined with the risk score of 55. The absence of open ports and services suggests either a dormant infrastructure or a purely internal/network-layer presence. The geolocation discrepancies (US vs RU signals) warrant monitoring but do not indicate active threat behavior. The subnet's low abuse density and neighbor risk profiles suggest this is an isolated moderate-risk address within otherwise benign infrastructure.

Classification: Moderate Risk — Monitor but block by default

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.