201.3.225.23📋 Copy

# IP Intelligence Briefing: 201.3.225.23

## Executive Summary

IP address 201.3.225.23 presents as a low-risk endpoint (risk score: 25) operating as a web server infrastructure component under IPBNB-LLC. The IP maintains minimal malicious indicators but sits within a subnet exhibiting elevated abuse activity, warranting contextual awareness for monitoring purposes.

## Ownership and Infrastructure

• Organization: IPBNB Abuse Contact / IPbnb-LLC
• ASN: 48031 (AS-IPBNB)
• CIDR Block: 201.3.225.0/24
• RIR: LACNIC (Latin America)
• Registration: Route origin stable (isRouteStable: false)

## Geolocation Assessment

• Reported Country: PL (Poland)
• Reported City: Stockholm (geographic inconsistency noted)
• Coordinates: 51.92°N, 19.15°E
• Accuracy Radius: 400km
• Validation: Geo validation flagged as implausible (geoPlausible: false)

## Service Exposure

• Open Ports:

- TCP/443 (HTTPS)

- TCP/22 (SSH - OpenSSH_10.2p1 Ubuntu-2ubuntu3.5)

• TLS Certificate: Self-signed certificate issued to www.cfwlndkjsh.net
• DNS Hostname: vm23361.bit.hosting
• Email Security: SPF and DMARC configured

## Threat Indicators

• Blacklist Count: 1 (of 8 total DNSBL lists)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Affiliations: None detected
• Control Plane: Route changes detected in 30-day window

## Neighborhood Analysis (201.3.225.0/24)

• Subnet Abuse Density: 0.3 (30%)
• Total Siblings: 10
• Active Siblings: 8
• Threat-Siblings: 3
• Risk Distribution: 0 high-risk, 5 medium-risk, 4 low-risk

Notable High-Risk Neighbors:

## Historical Observations

• Total Observations: 23
• Threat Persistence Days: 0
• Ownership Changes: 0
• Recent Activity: Multiple routing scans observed (2026-07-30 timeframe)
• Operator Score: 0.1304 (Minimal)
• Stability Classification: No persistent malicious behavior detected

## Relationship Graph

• Network Relationships: Multiple associations with IPBNB-LLC
• DNS Associations: vm23361.bit.hosting (10+ relationship entries)

## Recommended Actions

• Monitor: Observe traffic patterns due to subnet-level abuse density
• Block: No immediate blocking recommended; risk score remains low
• Investigate: Review SSH access patterns given port 22 exposure
• Contextual: Correlate with high-risk neighbors (201.3.225.20, .25, .26) for potential C2 infrastructure

## Conclusion

201.3.225.23 operates as a legitimate web hosting endpoint with minimal direct threat indicators. However, the elevated subnet abuse density (30%) and presence of three threat-siblings suggest this infrastructure may share operational characteristics with malicious actors within the same /24. SOC analysts should monitor for lateral movement patterns and consider the IP's geographic inconsistencies when validating origin claims.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.