85.218.223.215
IP Intelligence Dossier
Your IP: 216.73.217.135
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.
IP Intelligence Briefing: 85.218.223.215
Date: 2026-06-11
---
**1. Core Profile**
- Risk Score: 50 (Moderate Risk)
- Ownership: Registered to Stofa AS (ASN 39642) under the CDNET-CABLE network, Denmark.
- Geolocation: Geotagged to Hamburg, Germany (latitude/longitude unspecified), but ownership is linked to Denmark.
- Threat Indicators: No malicious activity detected (no known attackers, spam, or DNSBL listings).
- Network Role: Firewalled with no open services or TLS certificates.
---
**2. Observations & Behavior**
- Historical Signals (30-Day Window):
- 16 observations, with 4 flagged for potential threats (confidence: 0.6–0.85).
- Mixed geolocation data: Some signals suggest Denmark (Aarhus), others Germany (Hamburg).
- No persistent malicious behavior (threat persistence days: 0).
- DNS Configuration:
- PTR record: `85-218-223-215.norlyscustomer.net` (SPF enabled, no DMARC).
- No hosted domains or email authentication records.
- Network Stability:
- BGP route stability: Unstable (route changes in last 30 days).
- No CAA records, DNSSEC validation present.
---
**3. Relationships & Context**
- DNS Associations: Linked to `norlyscustomer.net` (SPF record only).
- Network Affiliation: Same subnet as CDNET-CABLE (85.218.220.0/22).
- Subnet Abuse Density: 0% (no malicious neighbors in /24 subnet).
---
**4. Recommendations**
- Monitor Geolocation Discrepancies: Investigate conflicting location data (Denmark vs. Germany).
- Enhance DNS Security: Implement DMARC for email authentication and monitor SPF misconfigurations.
- Review BGP Stability: Confirm route stability with ISP (Stofa AS) to prevent potential outages.
- Baseline Risk Profile: No immediate action required, but continuous monitoring advised due to mixed signal history.
---
Next Steps:
- Cross-check ownership with RDAP for abuse contact details.
- Validate DNSSEC and BGP configurations with network operators.
- Track changes in geolocation and threat signals over time.
Product: IPDebrief | Copyright: © 2026 Jason Alberino. All rights reserved.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Stofa AS |
| ASN | AS39642 |
| Network Name | CDNET-CABLE |
| CIDR Block | 85.218.220.0/22 |
| RIR | RIPE |
| Country | DK |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 85-218-223-215.norlyscustomer.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 85-218-223-215.norlyscustomer.net |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
No certificate
Issued by —
N/A
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 13% | 1 | 1 |
| routing | 13% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 0% | 0 | 0 |
| geolocation | 13% | 1 | 1 |
| Overall | 13% | 6 | 7 |
Coverage: 5/6 dimensions · Data sufficiency: partial
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-27 07:18:10 UTC |
| Last Seen | 2026-06-11 09:27:35 UTC |
| Profile Built | 2026-06-11 09:36:04 UTC |
| Data Freshness | Live |
| Signal Types | 21 |
| Total Observations | 21 |
🔍 21 signal types · 21 observations collected
This report is generated from 21+ independent intelligence signals including
ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds,
behavioral fingerprinting, and more.
Full dossier details are available via our API.
Full dossier details are available via our API.
ℹ️ About This Report
All data shown is publicly available network metadata — IP addresses do not reliably identify individuals.
Assessments are probabilistic and should not be used as sole basis for access control decisions.
To report an issue or request data review, contact admin@ipdebrief.com.