216.180.246.131📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 216.180.246.131/32

Classification: Low Risk

Date: 2026-07-24

## EXECUTIVE SUMMARY

IP 216.180.246.131 presents a low-risk profile with a reputation score of 25/100. The address is assigned to a private customer in the United States (New York region) under ASN 396982. No active services are running on this IP—it is firewalled with no open ports detected. The address resolves to hostname crawler131.deepfield.net.

## OWNERSHIP AND GEOLOCATION

• ASN: 396982
• Organization: Private Customer
• Netname: NET-216-180-246-0-24
• Registry: ARIN
• Location: United States, New York, US-NY
• Timezone: America/New_York

## NETWORK CLASSIFICATION

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• Tor Exit: No
• Known Attacker: No
• Spam Source: No
• Cloud/CDN/Proxy: No
• Residential: No

## THREAT INDICATORS

• Blacklist Status: Listed on 1 of 8 DNSBL checks
• Pulsedive Risk: Not available
• Known Campaigns: None identified
• Threat Feeds: No active indicators
• Abuse Confidence Score: Not available

The IP appears in historical threat data with has_threats: true and was observed in 37 pulse alerts from AlienVault OTX. DNSBL listings include high-severity entries.

## OBSERVATION HISTORY

Analysis of 15 observations reveals mixed signals:

• DNS resolution confirmed for crawler131.deepfield.net
• Multiple geolocation signals from MaxMind GeoLite2 and AlienVault OTX
• One observation flagged with has_threats: true
• Ownership has remained stable with no changes recorded
• Threat observation count: 0 (current state)

## NETWORK RELATIONSHIPS

• DNS Association: crawler131.deepfield.net (forward confirmed)
• Network Block: NET-216-180-246-0-24 (216.180.246.0/24)

## NEIGHBORHOOD ANALYSIS (216.180.246.0/24)

• Total Neighbors: 64
• Abuse Density: 0
• Risk Distribution:

- High Risk: 0

- Medium Risk: 7

- Low Risk: 57

• Classification: Clean subnet with minimal abuse activity

Selected neighbor risk scores range from 0-60, with 216.180.246.3 showing a risk score of 25 (similar to the target IP).

## SECURITY RECOMMENDATIONS

Based on the risk profile, the following actions are recommended:

1. Monitor but do not block: The IP is classified as low risk with no open services.

2. DNSBL Review: Investigate the single high-severity DNSBL listing to determine source and validity.

3. Historical Context: Review the 37 AlienVault OTX pulse alerts for the target IP to understand threat correlation.

4. Network-Level Policy: Consider subnet-level monitoring given the presence of 7 medium-risk neighbors in the /24.

## CONCLUSION

IP 216.180.246.131 is a low-risk address with no current active threats. The firewalled state with no services running suggests either a dormant host or a defensive configuration. Historical data shows past threat associations, but current indicators indicate benign behavior. No immediate blocking action is warranted, but maintain monitoring due to historical threat indicators and DNSBL presence.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.