201.3.225.22📋 Copy

# IPDebrief Intelligence Briefing

Subject: 201.3.225.22/32

Date: 2026-07-30

Classification: Low Risk – Monitoring Required

---

## Executive Summary

IP 201.3.225.22 presents a low-risk profile (risk score: 25) with minimal threat indicators. The address operates as a web server with HTTPS and SSH services, hosted within the IPbnb-LLC network (ASN 48031). While the IP itself shows no active malicious behavior, neighborhood analysis reveals elevated risk among adjacent subnets.

---

## Technical Profile

• Geolocation: PL (Poland region), Stockholm coordinates
• Network Ownership: IPbnb-LLC, ASN 48031
• CIDR Block: 201.3.225.0/24
• Service Purpose: Web Server
• Open Ports: TCP/443 (HTTPS), TCP/22 (SSH - OpenSSH 10.2p1 Ubuntu)
• PTR Hostname: vm23385.bit.hosting
• DNS Classification: Mixed abuse density (0.3/1.0)

---

## Threat Indicators

• Blacklist Status: Listed on 1 of 8 DNSBLs
• Threat Feeds: No active threat indicators
• Campaign Correlation: None detected
• Tor/Proxy: Not a Tor exit node or known proxy
• Abuse Confidence Score: Not applicable

---

## Temporal Analysis

Observation history indicates 25 signals collected with minimal operator score (0.1304). No persistent malicious activity detected. The IP maintains stable ownership with no recent threat persistence.

---

## Neighborhood Assessment

The 201.3.225.0/24 subnet shows mixed classification with 10 active sibling IPs and 3 identified threat siblings. Risk distribution:

• High Risk: 0 siblings
• Medium Risk: 5 siblings (e.g., 201.3.225.26 score 70)
• Low Risk: 4 siblings

Notable elevated-risk neighbors:

• 201.3.225.20 (risk: 66)
• 201.3.225.25 (risk: 66)
• 201.3.225.26 (risk: 70)

---

## Network Relationships

• Primary Organization: IPbnb-LLC (multiple network relationship entries)
• DNS Hostname: vm23385.bit.hosting
• Control Plane: BGP prefix 201.3.225.0/24, route stability: false
• RPKI: State not verified

---

## Recommended Actions

1. Monitoring: Continue passive monitoring due to low-risk profile

2. Rule Implementation: No immediate blocking required; consider rate-limiting SSH connections

3. Neighborhood Awareness: Monitor adjacent IPs (201.3.225.20, .25, .26) showing elevated risk scores

4. TLS Certificate Validation: Certificate issued for www.gvnokva3zuwi4gxcx.com/subject www.o6fjn2cl6yibkgp3e.net – verify legitimacy if receiving traffic

---

## Analyst Notes

The IP's classification as a web server with minimal threat indicators suggests legitimate hosting activity. However, the presence of DNSBL listings and elevated-risk neighboring IPs warrants continued observation. The mixed abuse density classification indicates the subnet contains both benign and potentially compromised hosts, typical of shared hosting environments.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.