# 85.203.36.3 — IP Intelligence Summary 85.203.36.3 is an IPv4 address operated by VPN-CN-RIPE-CO-ROLE (AS62240), geolocated to London, United Kingdom. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/85.203.36.3 - Last updated: 2026-10-06 ## Ownership - Organization: VPN-CN-RIPE-CO-ROLE - Network name: VPN-CN-GB - Allocated block: 85.203.36.0/24 - ASN: AS62240 (https://ipdebrief.com/asn/62240) - Regional registry: RIPE ## Location - City: London - Region: England - Country: United Kingdom - Time zone: Europe/London ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 85.203.36.3/32 \## Executive Summary IP address 85.203.36.3 is classified as **Low Risk** with a risk score of 0. The address belongs to ASN 62240 (VPN-CN-RIPE-CO-ROLE) within the 85.203.36.0/24 CIDR block, registered under RIR RIPE. Geolocation data places the IP in London, England, UK. No active threat indicators, blacklist listings, or malicious campaign associations were observed. \## Network Profile \- **IP Address:** 85.203.36.3 \- **Organization:** VPN-CN-RIPE-CO-ROLE \- **Network Name:** VPN-CN-GB \- **ASN:** 62240 \- **RIR:** RIPE \- **CIDR Block:** 85.203.36.0/24 \- **Geolocation:** London, England, GB (53.86°N, 0.63°E) \- **Timezone:** Europe/London \- **Abuse Contact:** Available via RDAP \## Risk Assessment The IP exhibits a risk score of 0 with no provider or authority score indicators. Threat analysis reveals: \- **Threat Indicators:** None detected \- **Blacklist Status:** Not listed on any blacklists (0/8 total checks) \- **Abuse Confidence Score:** Not applicable \- **Known Campaigns:** None associated \- **Network Role:** Firewalled / No Services The IP is not classified as a Tor exit node, known attacker, spam source, proxy, VPN, CDN, cloud service, hosting provider, mobile carrier, or residential address. \## Service and Network State \- **Open Ports:** None detected \- **DNS Records:** No PTR hostnames; forward resolution unsuccessful \- **Reverse DNS:** 3.36.203.85.in-addr.arpa (DNSSEC validated: true) \- **HTTP/HTTPS:** No active services \- **TLS Certificate:** None \## Control Plane Analysis \- **BGP Prefix:** 85.203.36.0/24 \- **Origin ASN:** 62240 \- **Route Stability:** No route changes observed in the last 30 days \- **RPKI State:** Not available \- **DNSSEC:** Valid \- **DNSBL Listings:** 0/8 \## Historical Observations Analysis of 12 signal observations reveals consistent network characteristics: \- **Geolocation:** Confirmed as GB (confidence: 0.40) \- **Organization:** VPN-CN-RIPE-CO-ROLE (confidence: 0.90) \- **Network Block:** 85.203.36.0/24 (confidence: 0.95) \- **DNSSEC:** Validated on reverse DNS record No temporal threat persistence or ownership changes detected. \## Neighborhood Analysis The 85.203.36.0/24 subnet contains 30 sibling IPs with the following characteristics: \- **Abuse Density:** 0 (minimal subnet-wide abuse) \- **Risk Distribution:** 30 low-risk IPs, 0 medium-risk, 0 high-risk \- **Notable Neighbors:** Several addresses show risk scores of 25, likely related to VPN infrastructure activity Representative sibling IPs include 85.203.36.7, 85.203.36.10, 85.203.36.11, and 85.203.36.184, all showing low-to-moderate risk profiles consistent with VPN service infrastructure. \## Relationships The IP shares network relationships with: \- **VPN-CN-GB** (network relationship - same subnet) \## Recommended Actions Based on the low-risk profile and absence of threat indicators: 1. **No immediate blocking required** - IP demonstrates normal operational behavior 2. **Continue passive monitoring** - Maintain standard observation protocols 3. **Review firewall rules** - Verify existing rules accommodate legitimate VPN traffic patterns 4. **Monitor subnet activity** - Watch for any changes in neighborhood risk distribution \## Conclusion 85.203.36.3 presents as a low-risk IP address associated with VPN infrastructure. No actionable threat indicators were identified during this intelligence gathering. The IP and its immediate neighborhood show consistent, benign network behavior. SOC teams may treat this address as non-threatening while maintaining standard monitoring practices. ## Nearby addresses - 85.203.36.7 (https://ipdebrief.com/85.203.36.7) - 85.203.36.10 (https://ipdebrief.com/85.203.36.10) - 85.203.36.11 (https://ipdebrief.com/85.203.36.11) - 85.203.36.13 (https://ipdebrief.com/85.203.36.13) - 85.203.36.14 (https://ipdebrief.com/85.203.36.14) - 85.203.36.18 (https://ipdebrief.com/85.203.36.18) - 85.203.36.19 (https://ipdebrief.com/85.203.36.19) - 85.203.36.20 (https://ipdebrief.com/85.203.36.20) - 85.203.36.22 (https://ipdebrief.com/85.203.36.22) - 85.203.36.23 (https://ipdebrief.com/85.203.36.23) - 85.203.36.24 (https://ipdebrief.com/85.203.36.24) - 85.203.36.25 (https://ipdebrief.com/85.203.36.25) --- Source: IPDebrief, "85.203.36.3 IP intelligence", https://ipdebrief.com/85.203.36.3, updated 2026-10-06. Assessments are probabilistic.