213.176.26.22📋 Copy

# IP INTELLIGENCE BRIEFING

IP Address: 213.176.26.22/32

Classification: Moderate Risk

Date: 2026-07-31

---

## EXECUTIVE SUMMARY

Target IP 213.176.26.22 is classified as Moderate Risk with a risk score of 50. The IP is registered to ASN 209425 (IROST-MNT) within the 213.176.24.0/22 CIDR block allocated by RIPE. No active threat indicators were identified. The IP shows no open ports or services and is not classified as a known attacker, spam source, Tor exit, proxy, or CDN.

---

## OWNERSHIP & NETWORK ATTRIBUTES

Geolocation Data:

• Country: NL (Netherlands)
• City: Nasimshahr (Shahrak-e-Shahab Sang)
• Region: Tehran
• Coordinates: 52.13°N, 5.29°E
• Accuracy: 150 km

---

## NETWORK BEHAVIOR & SERVICES

• Open Ports: None detected
• DNS PTR Records: Empty
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• SSL/TLS Certificates: None
• HTTP Services: None detected
• Service Purpose: Firewalled / No Services

---

## THREAT INTELLIGENCE

• Threat Indicators: None
• Known Campaigns: None
• Blacklist Count: 0
• DNSBL Listings: 2 of 8 total lists
• Is Known Attacker: No
• Is Spam Source: No
• Is Tor Exit: No
• Is Proxy: No

Operator Score: 0.1304 (Minimal)

Route Stability: False

BGP Prefix: 213.176.26.0/24

---

## OBSERVATION HISTORY

Total Observations: 13 signals

Key Observations:

• No ownership changes detected
• No threat persistence days recorded
• Not persistently malicious
• Recent geo signals from RDAP registration (NL country)
• ASN and network signals confirm RIPE allocation in 213.176.24.0/22 block
• Operator score indicates minimal threat operator activity

---

## NEIGHBORHOOD ANALYSIS (213.176.26.0/24)

Total Sibling IPs: 35

Abuse Density: 0

Risk Distribution:

• High Risk: 0
• Medium Risk: 24
• Low Risk: 11

Notable Neighbors:

• 213.176.26.44 (Risk: 65)
• 213.176.26.19, 213.176.26.21, 213.176.26.23, 213.176.26.29 (Risk: 50)

The subnet shows elevated medium-risk activity with 24 out of 35 sibling IPs scoring 50, suggesting potential concentrated risk in this /24.

---

## RELATIONSHIP GRAPH

Total Relationships: 2

Type: Same Network (MM500-NET)

Target Type: Network

---

## ACTIONS & RECOMMENDATIONS

Recommended Actions: None at this time. The IP shows no active threat indicators, no open ports, and no evidence of malicious behavior. However, monitoring is recommended due to:

1. DNSBL listings on 2 of 8 lists

2. Elevated neighborhood risk (24 medium-risk siblings in /24)

3. Route instability flag

Firewall Rules: No blocking required. Standard monitoring and logging recommended.

---

## INTELLIGENCE ASSESSMENT

Target 213.176.26.22 presents a Moderate Risk profile with no immediate threat indicators. The IP is registered to IROST-MNT (ASN 209425) and operates within a /24 subnet showing elevated medium-risk activity. While no active malicious behavior was observed, the DNSBL listings and neighborhood risk distribution warrant continued monitoring. No immediate blocking or mitigation actions are recommended.

Risk Score: 50/100

Recommended Action: Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.