213.226.72.140📋 Copy

# IP Intelligence Briefing: 213.226.72.140

Classification: Low Risk Infrastructure IP

Report Date: 2026-07-24

## Executive Summary

IP 213.226.72.140 is a low-risk residential/firewall-gated endpoint belonging to FORET Mathieu (ASN 41114) in Mondelange, France. The IP exhibits no active threat indicators, maintains a risk score of 25, and shows clean neighborhood classification. No immediate blocking or filtering actions are recommended.

## Ownership and Geolocation

• Organization: FORET Mathieu
• Network: FR-ORNETHD-20181204 (213.226.72.0/22)
• ASN: AS41114
• Location: Mondelange, France (FR)
• Registration: RIR RIPE
• Contact: Abuse contact available via RDAP

## Network Role Classification

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• Services: No active web services or TLS certificates
• Proxy/CDN/VPN: Not identified
• Hosting Status: Not a hosting provider

## Threat Intelligence Findings

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Status: 0 lists (clean)
• Threat Feeds: No matches
• Campaign Correlation: No known campaigns associated

Control Plane Data:

• BGP Prefix: 213.226.72.0/22
• Route Stability: False
• DNSBL Listings: 1 of 8 lists (single high-severity listing)
• RPKI State: Not verified
• IRR Consistency: Not verified

## DNS and Email Reputation

• PTR Hostname: cgnat-pool13.use-ipv6-thanks.infra.ornethd.net
• Forward Resolution: Not confirmed
• SPF Record: Present
• DMARC Record: Present
• DNSSEC: Valid

## Neighborhood Analysis (213.226.72.0/24)

• Abuse Density: 0% (Clean)
• Total Siblings: 3 IPs
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor Risk Scores:

- 213.226.72.133: Risk 25

- 213.226.72.164: Risk 25

## Relationship Graph

The IP maintains DNS associations with hostname cgnat-pool13.use-ipv6-thanks.infra.ornethd.net and network-level relationships within the FR-ORNETHD-20181204 network block.

## Historical Signals

Analysis of 18 observations reveals:

• Recent Classification: Clean subnet classification
• Geolocation Consensus: Multiple signals confirm France location
• Threat Persistence: 0 days (no persistent malicious activity)
• Ownership Changes: 0 (stable ownership)
• Signal Trend: Stable with no escalation

## Recommended Actions

Based on current risk assessment (Score: 25), no immediate firewall or filtering rules are recommended. The IP demonstrates characteristics of legitimate infrastructure with:

• No open ports requiring inspection
• Valid DNSSEC configuration
• Proper email authentication records (SPF/DMARC)
• Clean neighborhood classification
• No active threat indicators

SOC Analyst Guidance: Monitor periodically but no immediate action required. Add to whitelist if legitimate traffic patterns are confirmed.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.