24.234.239.46
## INTELLIGENCE BRIEFING: 24.234.239.46/32
Classification: HIGH RISK (Score: 80/100)
Date: Current
Analyst: IPDebrief Intelligence Team
Status: Active Threat Indicator
---
EXECUTIVE SUMMARY
IP address 24.234.239.46 is a residential ISP address assigned to Cox Communications Inc. (ASN 22773) exhibiting high-risk characteristics. The IP demonstrates elevated threat indicators including multiple DNSBL listings (5 of 8 lists), geolocation inconsistencies, and association with a subnet showing 66.7% abuse density. No active services detected on the target IP, but neighborhood analysis indicates correlated malicious activity.
---
OWNERSHIP & NETWORK CLASSIFICATION
| Attribute | Value |
|---|---|
| **ISP** | Cox Communications Inc. |
| **ASN** | 22773 |
| **CIDR Block** | 24.234.0.0/16 |
| **Network Name** | NETBLK-LV-CBS-24-234-0-0 |
| **Registration RIR** | ARIN |
| **Network Role** | Residential (Firewalled/No Services) |
| **Provider Score** | 0/100 |
| **Authority Score** | 0/100 |
DNS Resolution: wsip-234-239-46.lv.lv.cox.net (Forward confirmed: Yes)
---
GEOLOCATION ANALYSIS
Primary Location: New York, United States
Observed Variations: Georgia (30319), Las Vegas, Nevada
GeoValidation Status: Inconsistent (geoPlausible: false)
Timezone: America/New_York
Geo Source Count: 2 (Consensus: true)
*Note: Geographic discrepancies suggest potential proxy usage or spoofed headers.*
---
THREAT INDICATORS
| Indicator | Status |
|---|---|
| **Risk Score** | 80/100 (High) |
| **DNSBL Listed** | 5/8 lists |
| **Known Attacker** | No |
| **Tor Exit Node** | No |
| **Known Spam Source** | No |
| **Abuse Confidence Score** | Not calculated |
| **Threat Feeds** | Empty |
| **Campaign Matches** | None |
Control Plane Status:
- Operator Score: 0.2609 (Basic)
- DNSSEC Valid: true
- Route Stability: false
- MoAS: false
---
NEIGHBORHOOD ANALYSIS (24.234.239.0/24)
Abuse Density: 0.667 (66.7%)
Total Siblings: 3
Active Siblings: 3
| Neighbor IP | Risk Score | Authority Score | Classification |
|---|---|---|---|
| 24.234.239.13 | 80 | 60 | High Risk |
| 24.234.239.57 | 80 | 60 | High Risk |
| 24.234.239.235 | 15 | 60 | Low Risk |
*Two neighboring IPs exhibit identical high-risk scoring, suggesting coordinated or related malicious activity within the subnet.*
---
SIGNAL HISTORY (17 Observations)
Latest Observation: 2026-07-28
Ownership Changes: 0
Threat Persistence: None detected
Threat Observation Count: 0
Key Historical Signals:
- Geolocation inconsistencies observed across multiple probes
- Network ownership stable (Cox Communications)
- No persistent malicious behavior patterns identified
- Risk profile elevated despite lack of persistent threats
---
RELATIONSHIP GRAPH
DNS Associations: wsip-24-234-239-46.lv.lv.cox.net (multiple records)
Network Association: NETBLK-LV-CBS-24-234-0-0
Correlated Entities: 6 relationship entries (primarily DNS/network mappings)
*Relationships indicate standard residential ISP DNS PTR record configurations with no anomalous hostname associations.*
---
RECOMMENDED ACTIONS
Severity: CRITICAL
Category: Monitoring/Blocking
| Platform | Recommended Action |
|---|---|
| **iptables** | `iptables -A INPUT -s 24.234.239.46 -j DROP` |
| **nftables** | `nft add rule inet filter input ip saddr 24.234.239.46 drop` |
| **nginx** | `deny 24.234.239.46;` |
| **pfSense** | Block 24.234.239.46/32 |
| **Cloudflare WAF** | Block rule: `ip.src eq 24.234.239.46` |
| **AWS WAF** | Add IP 24.234.239.46/32 to deny list |
| **General** | Increase logging verbosity and review recent activity from this IP |
---
THREAT ASSESSMENT
This IP address presents moderate-to-high threat risk due to:
1. Elevated Risk Score (80/100) with multiple DNSBL listings
2. Subnet Abuse Density (66.7%) with two high-risk neighbors in the /24
3. Geographic Inconsistencies suggesting potential proxy or spoofing activity
4. Residential ISP Classification commonly associated with compromised endpoints
Recommended Mitigation: Implement blocking rules across perimeter devices and monitoring platforms. Consider blocking the entire /24 subnet if operational constraints permit, given the high abuse density and correlation with neighboring malicious IPs.
Threat Level: Monitor and Block
Priority: Medium-High
Confidence: High
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cox Communications Inc. |
| ASN | AS22773 |
| Network Name | NETBLK-LV-CBS-24-234-0-0 |
| CIDR Block | 24.234.0.0/16 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | wsip-24-234-239-46.lv.lv.cox.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | wsip-24-234-239-46.lv.lv.cox.net |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | 4/4 domains |
| DMARC | 4/4 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Not configured |
| Domains Checked | 4 domains |
☁️ Network Classification
| Infrastructure | Residential |
| Service Purpose | Web Server |
| Network Tier | End-User — Residential ISP endpoint |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| 22 | ssh | tcp | — |
| Closed Ports | 25, 3389, 8080, 8443 (3 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | 2025-05-03T07:30:23+00:00 |
| Valid Until | 2050-05-04T07:30:23+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| Signature Algorithm | sha256RSA |
| Validity Period | 9132 days |
🛡️ Public Network Snapshot
| Origin ASN | AS22773 |
| Network Prefix | 24.234.0.0/16 |
| Route mapping | Found |
| HSTS | Not detected |
| CSP | Not detected |
| HTTP/2 | Not detected |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 4 |
| routing | 8% | 1 | 1 |
| services | 32% | 2 | 3 |
| ownership | 34% | 2 | 6 |
| reputation | 26% | 1 | 3 |
| geolocation | 36% | 2 | 4 |
| Overall | 28% | 10 | 21 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-15 22:24:01 UTC |
| Last Seen | 2026-09-29 20:36:41 UTC |
| Profile Built | 2026-09-27 08:42:51 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 45 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 24.234.239.46
Who owns the IP address 24.234.239.46?
24.234.239.46 is registered to Cox Communications Inc.. The address falls within the 24.234.0.0/16 network block. Registration is held at ARIN.
Where is 24.234.239.46 located?
Geolocation data places 24.234.239.46 in Sunnyvale, CA, United States. The local time zone is America/Los_Angeles. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 24.234.239.46 malicious or safe?
24.234.239.46 currently carries a high risk assessment, meaning indicators associated with malicious or abusive activity have been observed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 24.234.239.46?
The reverse DNS (PTR) record for 24.234.239.46 is wsip-24-234-239-46.lv.lv.cox.net. This hostname is forward-confirmed, meaning it resolves back to the same address.
What ports are open on 24.234.239.46?
Responsive ports observed on 24.234.239.46 include 80, 443, 22. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.
Is 24.234.239.46 a VPN, proxy, or data center address?
24.234.239.46 is classified as a residential network based on network ownership and behavioural analysis.