65.111.26.246📋 Copy

# IP Intelligence Briefing: 65.111.26.246

## Executive Summary

IP address 65.111.26.246 presents a low-risk profile (risk score: 15) with minimal threat indicators. The IP is assigned to LIR DE-3XKTECHGMBH-20170616 under ASN 200373 and is classified as a single-service host. No active threat campaigns or known malicious activity has been observed.

## Technical Profile

## Threat Assessment

Current Threat Indicators: None

• Abuse Confidence Score: Not applicable
• Blacklist Status: Not listed (0/0)
• Known Campaigns: None
• Threat Feeds: Empty
• Is Tor Exit/Proxy/VPN: False
• Is Hosting/Cloud/Residential: False

DNS Reputation:

• DNSBL Listed Count: 1 (out of 8 total lists)
• No email authentication records (SPF/DMARC)
• No forward DNS resolution

Network Behavior:

• Open Port 22 (SSH) detected with "Exceeded MaxStartups" banner, indicating SSH configuration or connection attempts
• No HTTP/HTTPS services detected
• DNSSEC validation: Valid

## Subnet Analysis (65.111.26.0/24)

• Total Neighbors: 14
• Abuse Density: 0
• Risk Distribution: 7 low (50%), 5 medium (35%), 0 high (0%)
• Notable High-Risk Neighbors: 65.111.26.197 (risk: 65), 65.111.26.53, 65.111.26.105, 65.111.26.161, 65.111.26.205 (all risk: 40)

## Historical Observations

• Total Observations: 17
• Threat Persistence: None detected
• Ownership Changes: 0
• Recent Activity: Geo-location signals inconsistent (New York and Germany) with variable confidence levels (0.30–0.85)

## Relationship Graph

All 5 identified relationships point to the same network entity: DE-3XKTECHGMBH-20170616. No external entity associations detected (no hostnames, organizations, or certificates).

## Control Plane & Routing

• BGP Prefix: 65.111.26.0/24
• Route Stability: False
• Route Changes (30d): 0
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated
• DNSSEC: Valid

## Security Recommendations

No immediate action required. The IP presents low risk with no active threat indicators. However, consider the following:

1. Monitor SSH activity: Port 22 banner suggests potential SSH abuse or misconfiguration. Monitor for brute force attempts.

2. Contextual review: 5 neighboring IPs in the /24 subnet show medium risk scores (40). Review if any correlate with observed traffic patterns.

3. DNS reputation: 1 DNSBL listing warrants monitoring for potential future abuse.

## Conclusion

This IP is a single-service host with low-risk characteristics. The absence of threat indicators, combined with minimal operator score and no known campaigns, suggests legitimate infrastructure use. No blocking is recommended; standard monitoring practices apply.

---

*Intelligence generated by IPDebrief. Data accuracy subject to tool limitations and real-time verification.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.