213.176.26.109📋 Copy

# IP Intelligence Briefing: 213.176.26.109/32

## Executive Summary

IP address 213.176.26.109 presents a MODERATE RISK (Score: 50) profile with limited threat indicators. The asset is classified as a single-service host with active SSH service. Neighborhood analysis indicates a mixed-risk /24 subnet with elevated abuse density requiring contextual awareness.

## Ownership and Network Classification

• ASN: 209425 (IROST-MNT)
• Netname: MM500-NET
• CIDR Block: 213.176.24.0/22
• RIR: RIPE
• Network Role: Single-Service Host
• Geolocation: NL (Netherlands) - Geographic discrepancy noted with observed coordinates suggesting Tehran region (3,950km distance)

## Service Exposure

• Open Ports: TCP/22 (SSH - OpenSSH 7.4)
• DNS Resolution: No forward resolution confirmed
• Hosted Domains: None
• TLS/Certificate: Not applicable
• Email Authentication: SPF/DMARC not configured

## Threat Intelligence Findings

• Abuse Confidence Score: Not assigned
• Blacklist Status: Listed on 2 DNSBLs (out of 8 total)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected
• Threat Feeds: No matches
• Campaign Likelihood: None

## Control Plane Analysis

• BGP Prefix: 213.176.26.0/24
• Route Stability: False
• RPKI State: Not applicable
• DNSSEC: Valid
• Delegation Age: Not available
• Operator Score: 0.1304 (Minimal)

## Neighborhood Assessment (213.176.26.0/24)

• Total Siblings: 36
• Active Siblings: 27
• Threat Siblings: 3
• Abuse Density: 0.0833 (Low-Moderate)
• Subnet Classification: Mostly Clean

Risk Distribution:

• High Risk: 0
• Medium Risk: 24
• Low Risk: 11

Notable Neighbor: 213.176.26.44 (Risk Score: 65)

## Temporal Analysis

• Ownership Changes: 0
• Threat Persistence: 0 days
• Observation Count: 18
• Persistently Malicious: No
• Recent Activity: SSH service scan detected (2026-07-31)

## Recommended Security Actions

• Monitoring: Continue monitoring for service changes or new port openings
• Firewall Rules: Standard SSH access controls apply
• ISP Notification: Abuse contact available via RDAP
• Block Decision: No immediate block recommended; monitor for escalation

## Risk Assessment Summary

The IP maintains a stable, low-to-moderate risk profile with no active malicious indicators. The geographic discrepancy between claimed and observed location warrants monitoring but does not currently indicate compromise. The /24 subnet exhibits mixed-risk characteristics with several medium-risk neighbors that should be tracked for correlation.

Threat Level: LOW-MODERATE

Action Priority: MONITOR

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.