# 65.111.20.96 — IP Intelligence Summary

65.111.20.96 is an IPv4 address operated by lir-de-3xktechgmbh-1-MNT (AS200373), geolocated to São Paulo, Germany. As of October 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/65.111.20.96
- Last updated: 2026-10-05

## Ownership

- Organization: lir-de-3xktechgmbh-1-MNT
- Network name: DE-3XKTECHGMBH-20170616
- Allocated block: 65.111.0.0/19
- ASN: AS200373 (https://ipdebrief.com/asn/200373)
- Regional registry: ARIN

## Location

- City: São Paulo
- Region: São Paulo
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 65.111.20.96/32

\## Executive Summary

IP address 65.111.20.96 presents a low-risk profile (risk score: 25) with no active threat indicators. The IP belongs to a German network allocation with minimal operator classification. No immediate blocking or mitigation actions are recommended based on current intelligence.

\## Network Identity & Ownership

\- **ASN:** 200373 (lir-de-3xktechgmbh-1-MNT)

\- **Network:** DE-3XKTECHGMBH-20170616 (65.111.0.0/19)

\- **Registration:** ARIN RIR

\- **Network Role:** Single-Service Host

\- **Classification:** Not CDN/Cloud/VPN/Proxy/Tor/Hosting/Residential

\## Geolocation Analysis

\- **Reported Country:** DE (Germany)

\- **Reported Region/City:** São Paulo, Brazil

\- **Coordinates:** 51.17°N, 10.45°E

\- **Data Quality Flag:** ⚠️ **Inconsistent** — RTT measurements (37.4ms avg) contradict geographic distance (~9,900km would require ~198ms minimum RTT). Geolocation data may be unreliable.

\## Threat Assessment

\- **Risk Score:** 25 (Low)

\- **Blacklist Status:** Listed on 1 of 8 DNSBL feeds

\- **Known Threats:** None

\- **Campaign Association:** None identified

\- **Abuse Confidence Score:** Not available

\- **Tor Exit/Proxy:** No

\## Network Services & Exposure

\- **Open Ports:** TCP/22 (SSH) — banner indicates "Exceeded MaxStartups"

\- **DNS Records:** None resolved

\- **Email Authentication:** No SPF/DMARC records

\- **TLS/HTTP:** No certificates or web services detected

\## Control Plane & Routing

\- **BGP Prefix:** 65.111.20.0/24

\- **Route Stability:** False (routing instability detected)

\- **DNSSEC:** Valid

\- **Operator Score:** 0.1304 (Minimal)

\## Neighborhood Analysis (65.111.20.0/24)

\- **Abuse Density:** 0 (Clean)

\- **Subnet Classification:** Clean

\- **Siblings:** 4 total, 2 active

\- **Threat Siblings:** 0

\- **Risk Distribution:** 2 low-risk, 0 medium/high-risk

\## Historical Observations (17 signals)

Recent activity shows consistent scanning with no escalation in threat posture. No evidence of persistent malicious behavior or ownership changes.

\## Recommended Actions

\- **Firewall/Blocking:** Not required — low-risk profile

\- **Monitoring:** Standard logging recommended due to open SSH port

\- **Geolocation Verification:** Recommended due to location inconsistencies

\- **Alerting:** No specific thresholds exceeded

\## Analyst Notes

While the IP maintains a clean threat profile, the geolocation discrepancy (DE registry vs. Brazil coordinates) warrants periodic revalidation. The DNSBL listing (1/8 feeds) does not correlate with active malicious indicators. Route instability may indicate recent network changes.

**Classification:** LOW RISK — No immediate action required.

## Nearby addresses

- 65.111.20.3 (https://ipdebrief.com/65.111.20.3)
- 65.111.20.37 (https://ipdebrief.com/65.111.20.37)
- 65.111.20.112 (https://ipdebrief.com/65.111.20.112)

---

Source: IPDebrief, "65.111.20.96 IP intelligence", https://ipdebrief.com/65.111.20.96, updated 2026-10-05. Assessments are probabilistic.