201.3.225.24📋 Copy

# IP Intelligence Briefing: 201.3.225.24

## Executive Summary

Target IP 201.3.225.24 is a low-risk server (risk score: 25/100) operating within the IPbnb-LLC network block (201.3.225.0/24). The IP is classified as a web server with minimal operator risk (0.1304) and is currently not flagged as a known attacker or spam source. However, the subnet exhibits moderate abuse density (0.3), with 3 threat-identified siblings requiring monitoring.

## Infrastructure Profile

Ownership & Registration

• ASN: 48031 (IPBNB Abuse Contact)
• Organization: IPbnb-LLC
• CIDR Block: 201.3.225.0/24
• RIR: LACNIC (Latin America and Caribbean)
• Network Classification: Provider / Tor Exit Nodes

Geolocation

• Country: Poland (PL)
• City: Stockholm (data discrepancy noted)
• Accuracy Radius: 400km
• Geo-Consensus: Validated across multiple sources

DNS Configuration

• PTR Hostname: vm23364.bit.hosting
• Domain: bit.hosting
• Forward Resolution: Confirmed (1 hostname)
• Email Auth: SPF and DMARC records present

## Network Services & Fingerprinting

Open Ports & Services

TLS Certificate Analysis

• Issuer: CN=www.ld22dpp4.com
• Subject: CN=www.l3qaalepn.net
• Certificate Type: Self-signed (false positive flag)
• SANs: None detected
• HTTP Title: Not detected

## Threat Intelligence Assessment

Current Threat Status

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not detected
• Blacklist Count: 0
• Known Campaigns: None
• Threat Feeds: No matches
• Tor Exit Node: False (though classified in network role)

Control Plane Indicators

• Route Stability: False (not route stable)
• DNSBL Listed: 1 of 8 lists
• BGP Prefix: 201.3.225.0/24
• RPKI State: Not verified
• IRR Consistency: Not verified
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis

Subnet Overview: 201.3.225.0/24

• Total Siblings: 10
• Active Siblings: 7
• Threat-Identified Siblings: 3
• Abuse Density: 0.3 (Moderate)
• Classification: Mixed

High-Risk Neighbors Identified

## Historical Observations

Observation Count: 24 signals tracked

• Most Recent: 2026-07-30 20:29:54 UTC
• Signal Types: Geolocation, DNS, Operator, and threat observations
• Consistency: Operator score stable at 0.1304 across all observations
• Threat Persistence: 0 days (no persistent malicious activity detected)
• Ownership Changes: 0 (stable ownership)

## Relationship Graph

Primary Associations:

• Network: IPbnb-LLC (multiple same-network relationships)
• Hostname: vm23364.bit.hosting (DNS association)

## Recommended Security Actions

Based on the current risk profile and neighborhood context:

1. Monitor Subnet Activity: The 201.3.225.0/24 subnet contains 3 threat-identified IPs. Monitor for lateral movement or coordinated activity.

2. Traffic Filtering: No immediate blocking recommended for this IP. However, consider rate-limiting SSH access (port 22) due to the open service.

3. TLS Certificate Verification: The self-signed certificate with mismatched issuer/subject warrants investigation. Verify if this is a legitimate hosting configuration or potential misconfiguration.

4. DNSBL Monitoring: The IP is listed on 1 of 8 DNSBLs. Monitor for additional listings and investigate the specific blacklist.

5. Geolocation Verification: Discrepancy between Poland country code and Stockholm city location requires validation.

## Intelligence Assessment

IP 201.3.225.24 presents a low-risk profile with no active malicious indicators. The infrastructure is operational as a web server with standard HTTPS/SSH services. While the subnet shows moderate abuse density, the target IP itself does not exhibit threat characteristics. Continued monitoring of the subnet is recommended due to the presence of high-risk neighbors (201.3.225.20, 201.3.225.25, 201.3.225.26). No immediate defensive action required beyond standard network hygiene.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.