# 65.111.26.29 — IP Intelligence Summary

65.111.26.29 is an IPv4 address operated by lir-de-3xktechgmbh-1-MNT (AS200373), geolocated to New York, Germany. As of October 11, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/65.111.26.29
- Last updated: 2026-10-11

## Ownership

- Organization: lir-de-3xktechgmbh-1-MNT
- Network name: DE-3XKTECHGMBH-20170616
- Allocated block: 65.111.0.0/19
- ASN: AS200373 (https://ipdebrief.com/asn/200373)
- Regional registry: ARIN

## Location

- City: New York
- Region: US-NY
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 22/tcp — ssh

## Analyst narrative

\# IP Intelligence Briefing: 65.111.26.29/32

**Classification:** LOW RISK | **Date:** 2026-07-27 | **Analyst:** SOC Intelligence

\---

\## Executive Summary

IP address 65.111.26.29 is assessed as low risk with a risk score of 15/100. The address belongs to a German-registered network block (65.111.0.0/19) under ARIN RIR. No active threat indicators, known campaigns, or blacklist listings have been observed. The IP shows no open services, appears firewalled, and demonstrates stable ownership characteristics.

\---

\## Network Ownership & Registration

| Attribute | Value |

|-----------|-------|

| **Organization** | lir-de-3xktechgmbh-1-MNT |

| **Netname** | DE-3XKTECHGMBH-20170616 |

| **ASN** | 200373 |

| **CIDR Block** | 65.111.0.0/19 |

| **RIR** | ARIN |

| **Abuse Contact** | Available via RDAP |

| **Abuse Email** | friedrich.kraeft@3xktech.cloud |

The network registration indicates a legitimate infrastructure operator based in Germany with standard abuse notification procedures in place.

\---

\## Geolocation Analysis

| Attribute | Value |

|-----------|-------|

| **Country** | DE (Germany) |

| **Coordinates** | 51.17°N, 10.45°E |

| **Timezone** | Europe/Berlin |

| **Accuracy Radius** | 400km |

| **Geo Plausibility** | Valid |

| **RTT (avg)** | 108.6ms |

Geolocation consensus shows the IP is physically located in Germany, consistent with network registration data.

\---

\## Threat Intelligence Assessment

**Threat Indicators:** None detected

\- Not a known attacker

\- Not a spam source

\- Not a Tor exit node

\- No associated threat campaigns

\- Blacklist count: 0

\- Abuse confidence score: Not applicable

**Control Plane Status:**

\- Route stability: Unstable

\- DNSSEC: Valid

\- DNSBL listings: 1 of 8 total lists

\- Operator score: 0.1304 (Minimal risk)

\---

\## Network Services & DNS

**Open Ports:** None detected

**Services:** Firewalled / No Services

**TLS Certificates:** None

**DNS Records:** No PTR hostnames, no forward resolution, no hosted domains

**Email Authentication:** No SPF or DMARC records configured

The absence of open ports and services suggests this IP is not actively serving traffic or may be behind firewall protection.

\---

\## Neighborhood Analysis (65.111.26.0/24)

\- **Total Siblings:** 11

\- **Abuse Density:** 0 (minimal)

\- **High Risk Neighbors:** 0

\- **Medium Risk Neighbors:** 3

\- **Low Risk Neighbors:** 7

**Notable Neighbor:** 65.111.26.197 shows elevated risk score of 65, suggesting potential localized abuse within the subnet.

\---

\## Historical Signals

Fifteen observations recorded within recent timeframe. Key observations:

\- Traceroute: 13 hops with 2 timeouts, transit via Comcast

\- Geographic inference consistently points to Germany

\- No significant changes in ownership or threat posture

\- No evidence of persistent malicious behavior

\---

\## Recommended Actions

**Current Risk Score:** 15/100 (Low)

**Action Required:** None

No firewall rules or blocking recommendations are warranted at this time. The IP does not meet thresholds for immediate mitigation. Continue standard monitoring practices.

\---

\## Conclusion

IP 65.111.26.29 presents minimal threat. The address is part of a legitimate German network registration with no active threat indicators. The subnet shows minimal abuse density, though one neighbor (65.111.26.197) warrants separate monitoring. No immediate defensive actions are recommended.

\---

*Intelligence generated by IPDebrief Platform. Data current as of 2026-07-27.*

## Nearby addresses

- 65.111.26.24 (https://ipdebrief.com/65.111.26.24)
- 65.111.26.42 (https://ipdebrief.com/65.111.26.42)
- 65.111.26.53 (https://ipdebrief.com/65.111.26.53)
- 65.111.26.59 (https://ipdebrief.com/65.111.26.59)
- 65.111.26.76 (https://ipdebrief.com/65.111.26.76)
- 65.111.26.77 (https://ipdebrief.com/65.111.26.77)
- 65.111.26.105 (https://ipdebrief.com/65.111.26.105)
- 65.111.26.117 (https://ipdebrief.com/65.111.26.117)
- 65.111.26.119 (https://ipdebrief.com/65.111.26.119)
- 65.111.26.128 (https://ipdebrief.com/65.111.26.128)
- 65.111.26.130 (https://ipdebrief.com/65.111.26.130)
- 65.111.26.136 (https://ipdebrief.com/65.111.26.136)

---

Source: IPDebrief, "65.111.26.29 IP intelligence", https://ipdebrief.com/65.111.26.29, updated 2026-10-11. Assessments are probabilistic.