# 65.111.26.197 — IP Intelligence Summary

65.111.26.197 is an IPv4 address operated by lir-de-3xktechgmbh-1-MNT (AS200373), geolocated to New York, Germany. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/65.111.26.197
- Last updated: 2026-10-06

## Ownership

- Organization: lir-de-3xktechgmbh-1-MNT
- Network name: DE-3XKTECHGMBH-20170616
- Allocated block: 65.111.0.0/19
- ASN: AS200373 (https://ipdebrief.com/asn/200373)
- Regional registry: ARIN

## Location

- City: New York
- Region: US-NY
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 65.111.26.197/32

**Classification:** Moderate Risk | **Risk Score:** 65/100

**Report Date:** 2026-07-27

**Prepared For:** SOC Operations

\---

\## EXECUTIVE SUMMARY

IP 65.111.26.197 presents moderate risk with a score of 65/100. The address belongs to ASN 200373 (DE-3XKTECHGMBH-20170616) with 3 DNSBL listings across 8 total lists. No active services detected on open ports, and the subnet demonstrates low abuse density (0). No known attacker or spam source indicators.

\---

\## OWNERSHIP & GEOGRAPHY

| Attribute | Value |

|-----------|-------|

| ASN | 200373 |

| Organization | lir-de-3xktechgmbh-1-MNT (DE-3XKTECHGMBH-20170616) |

| RIR | ARIN |

| CIDR Block | 65.111.0.0/19 |

| Primary Country | DE (Germany) |

| Geolocation Consensus | US-NY (1,550.7km distance) |

| Registration Date | Data unavailable |

| Abuse Contact | Available via RDAP |

\---

\## THREAT INDICATORS

| Indicator | Status |

|-----------|--------|

| Known Attacker | No |

| Spam Source | No |

| Tor Exit Node | No |

| VPN/Proxy | No |

| Cloud/CDN | No |

| Bogon Address | No |

| Blacklist Count | 0 |

| Pulsedive Risk | Data unavailable |

| Known Campaigns | None identified |

**Control Plane:** 3 DNSBL listings detected (minimal operator score: 0.1304). Route stability flagged as false; no route changes in 30 days.

\---

\## NETWORK ENVIRONMENT

**Subnet Analysis (65.111.26.0/24):**

\- Total Neighbors: 11

\- Risk Distribution: 0 High, 2 Medium, 8 Low

\- Abuse Density: 0

\- Threat Siblings: 0

**Notable Neighbors:**

\- 65.111.26.53 (Risk: 40)

\- 65.111.26.205 (Risk: 40)

\- Multiple IPs with Risk: 15

\---

\## NETWORK SERVICES

\- **Open Ports:** None detected

\- **SSL/TLS:** No certificates observed

\- **HTTP:** No title/banner data

\- **DNS:** No PTR hostnames; no forward resolution confirmed

\- **Email Auth:** SPF/DMARC not configured (no hosted domains)

\---

\## OBSERVATION HISTORY (17 Signals)

Recent activity indicates:

\- SSH banner detected: OpenSSH 9.6p1 Ubuntu-3ubuntu13.18

\- Traceroute: 13 hops via Comcast transit networks

\- Geo-inference: Germany (51.17, 10.45) with 400km accuracy radius

\- No persistent malicious behavior observed

\- Ownership stable with zero changes recorded

\---

\## NETWORK TRACEROUTE

\- **Total Hops:** 13

\- **First Hop RTT:** 0.2ms

\- **Last Hop RTT:** 107.6ms

\- **Transit Networks:** Comcast

\- **Timeouts:** 2 hops

\---

\## SOC ACTIONS & RECOMMENDATIONS

Based on profile analysis:

\- **Immediate Action:** Monitor but no blocking required

\- **Context:** Low abuse density subnet with moderate-risk host

\- **DNSBL:** 3 listings warrant awareness but not immediate escalation

\- **Traffic Analysis:** No active services suggest dormant or firewalled endpoint

\- **Investigation Priority:** MEDIUM (score 65/100, but no active threat indicators)

**Recommended Rules:** Standard monitoring; no explicit firewall rules generated.

\---

\## INTELLIGENCE ASSESSMENT

The IP addresses an inactive or heavily restricted endpoint within a German organization's network range. Moderate risk score derives from DNSBL presence rather than active malicious behavior. Subnet analysis shows minimal abuse density, suggesting the address may be legacy, misconfigured, or part of a non-public infrastructure. No correlation to known campaigns or attacker infrastructure.

**Confidence Level:** HIGH (data from 17 historical observations, 11 neighbor lookups)

\---

*Intel generated via IPDebrief Platform | For SOC Operations Use Only*

## Nearby addresses

- 65.111.26.24 (https://ipdebrief.com/65.111.26.24)
- 65.111.26.29 (https://ipdebrief.com/65.111.26.29)
- 65.111.26.42 (https://ipdebrief.com/65.111.26.42)
- 65.111.26.53 (https://ipdebrief.com/65.111.26.53)
- 65.111.26.59 (https://ipdebrief.com/65.111.26.59)
- 65.111.26.76 (https://ipdebrief.com/65.111.26.76)
- 65.111.26.77 (https://ipdebrief.com/65.111.26.77)
- 65.111.26.105 (https://ipdebrief.com/65.111.26.105)
- 65.111.26.117 (https://ipdebrief.com/65.111.26.117)
- 65.111.26.119 (https://ipdebrief.com/65.111.26.119)
- 65.111.26.128 (https://ipdebrief.com/65.111.26.128)
- 65.111.26.130 (https://ipdebrief.com/65.111.26.130)

---

Source: IPDebrief, "65.111.26.197 IP intelligence", https://ipdebrief.com/65.111.26.197, updated 2026-10-06. Assessments are probabilistic.