23.95.122.72
# IP Intelligence Briefing: 23.95.122.72/32
Classification: Moderate Risk (Score: 40) | Date: July 28, 2026
---
## Executive Summary
IP 23.95.122.72 is a multi-service host registered to CENTRIOHOST-LLC (AS36352) in the United States. The IP presents a moderate risk profile (40/100) with no active threat indicators, but exhibits geo-irregularities and is listed on 2 of 8 DNSBLs. Open SSH and RDP services require validation against organizational policy before blocking.
---
## Ownership & Registration
| Field | Value |
|---|---|
| **ASN** | 36352 (CENTRIOHOST-LLC) |
| **Organization** | CENTRIOHOST-LTD |
| **CIDR Block** | 23.95.122.0/25 |
| **RIR** | ARIN |
| **Abuse Contact** | noc-admin@zelt.ae |
---
## Geolocation Analysis
Primary Location: New York, Buffalo, US
Historical Geolocation Inconsistencies:
- Recent probes show conflicting geolocation data between US (Buffalo) and Bangladesh
- Geo validation flagged as implausible; distance and RTT data unavailable
- This discrepancy warrants attention for potential reputation laundering
---
## Network Services & Exposed Ports
| Port | Protocol | Service | Status |
|---|---|---|---|
| 22 | TCP | SSH | Open (OpenSSH 9.6p1 Ubuntu) |
| 3389 | TCP | RDP | Open (no banner) |
No TLS certificates or HTTP content detected. Email authentication records (SPF/DMARC) are present but values not populated in probe.
---
## Threat Indicators
| Indicator | Status |
|---|---|
| Known Attacker | No |
| Tor Exit Node | No |
| Spam Source | No |
| Blacklist Count | 0 |
| DNSBL Listings | 2 of 8 |
| Known Campaigns | None |
| Threat Persistence | Not observed |
Operator Score: 0.1304 (Minimal)
---
## Neighborhood Analysis
Subnet 23.95.122.0/24 exhibits low abuse density (0.0).
| Neighbor | Risk Score | Authority Score |
|---|---|---|
| 23.95.122.71 | 0 | 50 |
No significant abuse patterns observed in immediate subnet vicinity.
---
## Relationship Graph
- Network: CENTRIOHOST-LTD (multiple associations)
- DNS Hostnames: 23-95-122-72-host.colocrossing.com (multiple associations)
---
## Historical Signal Trajectory
Fifteen observations recorded through July 28, 2026. Signals indicate:
- Consistent ownership attribution to CENTRIOHOST-LLC
- Persistent geolocation inconsistencies between US and Bangladesh
- No observed escalation in threat indicators
---
## Recommended Actions
Default Recommendation: Block (Risk Score 40)
Firewall Rules:
- iptables: `iptables -A INPUT -s 23.95.122.72 -j DROP`
- nftables: `nft add rule inet filter input ip saddr 23.95.122.72 drop`
- Cloudflare WAF: `ip.src eq 23.95.122.72` (Block)
- AWS WAF: `Addresses: ["23.95.122.72/32"]` (Block)
Assessment: While the default recommendation is to block, the moderate risk score combined with legitimate hosting infrastructure classification and no active threat indicators suggests this may be a false positive. SOC analysts should validate against internal traffic logs and business context before implementing blocking rules.
---
Report Generated: IPDebrief Intelligence Platform
Analyst Notes: Monitor for any changes in threat indicators. The Bangladesh/US geolocation discrepancy is unusual for a US-hosted IP and may warrant deeper investigation if associated with suspicious traffic patterns.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | CENTRIOHOST-LLC. |
| ASN | AS36352 |
| Network Name | CENTRIOHOST-LTD |
| CIDR Block | 23.95.122.0/25 |
| RIR | ARIN |
| Country | Bangladesh |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 23-95-122-72-host.colocrossing.com |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | 23-95-122-72-host.colocrossing.com |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Multi-Service Host |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | Banner detected |
| 3389 | rdp | tcp | — |
| Closed Ports | 25, 80, 443, 8080, 8443 (2 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS36352 |
| Network Prefix | 23.95.122.0/24 |
| Route mapping | Found |
| Certificates in transparency logs | 0 certificates |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 8 |
| routing | 8% | 1 | 1 |
| services | 12% | 2 | 2 |
| ownership | 17% | 2 | 3 |
| reputation | 20% | 1 | 4 |
| geolocation | 20% | 2 | 4 |
| Overall | 19% | 10 | 22 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-16 16:44:11 UTC |
| Last Seen | 2026-09-14 17:17:01 UTC |
| Profile Built | 2026-09-12 18:53:55 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 35 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 23.95.122.72
Who owns the IP address 23.95.122.72?
23.95.122.72 is registered to CENTRIOHOST-LLC.. The address falls within the 23.95.122.0/25 network block. Registration is held at ARIN.
Where is 23.95.122.72 located?
Geolocation data places 23.95.122.72 in Buffalo, New York, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 23.95.122.72 malicious or safe?
23.95.122.72 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 23.95.122.72?
The reverse DNS (PTR) record for 23.95.122.72 is 23-95-122-72-host.colocrossing.com. This hostname is not forward-confirmed, so it should be treated as a weak signal.
What ports are open on 23.95.122.72?
Responsive ports observed on 23.95.122.72 include 22, 3389. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.