216.180.246.36📋 Copy

# IP Intelligence Briefing: 216.180.246.36/32

Classification: Low Risk | Date Generated: 2026-07-23

## Executive Summary

IP address 216.180.246.36/32 presents a low-risk profile with an overall risk score of 25. The address resolves to a private customer network under ARIN registration (AS396982) and demonstrates minimal threat indicators. No active malicious campaigns, known attacker signatures, or spam source indicators were detected during analysis.

## Ownership and Network Context

The IP belongs to ASN 396982, registered as a "Private Customer" under the ARIN registry with CIDR block 216.180.246.0/24. Geolocation data indicates US origin with Massy as the reported location. The network role classification indicates "Firewalled / No Services," suggesting no publicly accessible services are running from this address.

## Threat Intelligence Assessment

Threat Indicators: No threat indicators present. The IP is not classified as a Tor exit node, known attacker, or spam source. Blacklist count shows zero entries across threat feeds.

Network Abuse Context: The /24 subnet (216.180.246.0/24) demonstrates an abuse density of 0.0462. Within the neighborhood of 65 total sibling IPs, 14 remain active with 3 classified as threats. Risk distribution across the subnet shows 59 low-risk, 5 medium-risk, and 0 high-risk neighbors.

## DNS and Service Analysis

DNS PTR records resolve to crawler036.deepfield.net. Forward resolution confirms this hostname with one resolved entry. No DNS authentication records (SPF, DMARC) were detected. No open ports or services are currently accessible on this IP address.

## Observation History

Analysis of 17 historical observations reveals:

• Subnet abuse density maintained at 0.0462
• Classification consistently marked as "clean"
• No ownership changes recorded
• No threat persistence patterns detected
• No persistent malicious behavior observed

## Related Entities

Seven relationships were identified:

• DNS associations to crawler036.deepfield.net (repeated entries)
• Same network association to NET-216-180-246-0-24

## Recommended Actions

No specific firewall rules or blocking recommendations are generated based on current risk profile. The low-risk classification (score 25) combined with clean subnet classification supports maintaining current traffic handling without additional restrictions.

## Analyst Notes

This IP presents minimal threat to defensive operations. The "crawler036.deepfield.net" hostname suggests potential automated scanning or reconnaissance activity, though no malicious indicators are present. Monitoring should continue but does not require immediate escalation or blocking at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.