65.111.26.197📋 Copy

# IP INTELLIGENCE BRIEFING: 65.111.26.197/32

Classification: Moderate Risk | Risk Score: 65/100

Report Date: 2026-07-27

Prepared For: SOC Operations

---

## EXECUTIVE SUMMARY

IP 65.111.26.197 presents moderate risk with a score of 65/100. The address belongs to ASN 200373 (DE-3XKTECHGMBH-20170616) with 3 DNSBL listings across 8 total lists. No active services detected on open ports, and the subnet demonstrates low abuse density (0). No known attacker or spam source indicators.

---

## OWNERSHIP & GEOGRAPHY

---

## THREAT INDICATORS

Control Plane: 3 DNSBL listings detected (minimal operator score: 0.1304). Route stability flagged as false; no route changes in 30 days.

---

## NETWORK ENVIRONMENT

Subnet Analysis (65.111.26.0/24):

• Total Neighbors: 11
• Risk Distribution: 0 High, 2 Medium, 8 Low
• Abuse Density: 0
• Threat Siblings: 0

Notable Neighbors:

• 65.111.26.53 (Risk: 40)
• 65.111.26.205 (Risk: 40)
• Multiple IPs with Risk: 15

---

## NETWORK SERVICES

• Open Ports: None detected
• SSL/TLS: No certificates observed
• HTTP: No title/banner data
• DNS: No PTR hostnames; no forward resolution confirmed
• Email Auth: SPF/DMARC not configured (no hosted domains)

---

## OBSERVATION HISTORY (17 Signals)

Recent activity indicates:

• SSH banner detected: OpenSSH 9.6p1 Ubuntu-3ubuntu13.18
• Traceroute: 13 hops via Comcast transit networks
• Geo-inference: Germany (51.17, 10.45) with 400km accuracy radius
• No persistent malicious behavior observed
• Ownership stable with zero changes recorded

---

## NETWORK TRACEROUTE

• Total Hops: 13
• First Hop RTT: 0.2ms
• Last Hop RTT: 107.6ms
• Transit Networks: Comcast
• Timeouts: 2 hops

---

## SOC ACTIONS & RECOMMENDATIONS

Based on profile analysis:

• Immediate Action: Monitor but no blocking required
• Context: Low abuse density subnet with moderate-risk host
• DNSBL: 3 listings warrant awareness but not immediate escalation
• Traffic Analysis: No active services suggest dormant or firewalled endpoint
• Investigation Priority: MEDIUM (score 65/100, but no active threat indicators)

Recommended Rules: Standard monitoring; no explicit firewall rules generated.

---

## INTELLIGENCE ASSESSMENT

The IP addresses an inactive or heavily restricted endpoint within a German organization's network range. Moderate risk score derives from DNSBL presence rather than active malicious behavior. Subnet analysis shows minimal abuse density, suggesting the address may be legacy, misconfigured, or part of a non-public infrastructure. No correlation to known campaigns or attacker infrastructure.

Confidence Level: HIGH (data from 17 historical observations, 11 neighbor lookups)

---

*Intel generated via IPDebrief Platform | For SOC Operations Use Only*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.