Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
185.213.154.246
Executive Summary
The claim is simply an IP address, 185.213.154.246. Multiple network lookups and IP-range records show that this address falls inside the 185.213.154.0/24 block, which current public datasets largely associate with AS39351 / 31173 Services AB, and measurements report the address as non‑pingable in many probes. Conflicting prior references to other ASNs or organizations reflect either adjacent netblocks (185.213.x.0/24 variants) or older/partial datasets; authoritative verification requires a live WHOIS/RIPE query and traceroute from multiple vantage points [1] [2] [3].
1. Why the single IP claim matters and what datasets reveal about it
The bare IP string “185.213.154.246” is a neutral identifier whose relevance depends on network-owner and activity context; contemporary IP-range databases list this address within the 185.213.154.0/24 CIDR, linking the netblock to ASN AS39351 / 31173 Services AB in public measurements. IPinfo and IPGeolocation extracts show the /24 block hosting multiple domains but reporting many non‑responding addresses on active probes, and specific scans mark .246 as not pingable in at least one recent dataset (measurement snapshots dated October–September 2025) [1] [2]. Older entries that reference different ASNs or organizations reflect either distinct adjacent /24s (for example 185.213.26.0/24) or records updated at different times, underscoring that IP->owner mappings can shift and must be confirmed with current WHOIS/RIPE data [4] [5].
2. The evidence supporting AS39351 ownership and active measurements
Network-level scans and traceroutes performed and archived by IPinfo and similar services show the 185.213.154.0/24 prefix announced via AS39351, and at least one traceroute to a nearby address (.30) completed with low latency from a European probe, indicating the netblock’s routability and presence in certain locations (Falkenberg, SE) on dates in late 2025. These records also report the specific IP .246 as lacking a hostname and returning no ping responses in probes, which suggests either host downtime, firewalling, or filtering at the provider edge rather than an absence from the routed table [1]. The block’s metadata from IP-range pages notes hosted domains and AS-level attribution, supporting the conclusion that .246 is allocated in a routable block managed by AS39351, even if that specific host is silent on active probes [2].
3. Conflicting attributions and why they appear in the sources
Some prior analyses tied addresses in the broader 185.213.* space to other operators (HostHatch, PureVoltage, Elmec) or different ASNs; those conflicting attributions arise from several concrete causes: IP blocks are split into many /24s and reassigned, WHOIS snapshots age, registrar/AS announcements change, and commercial lookup tools may surface neighboring-range info when exact matches are absent. The older 2017 record referencing 185.213.26.0/24 and a 2025 AS26548 entry reflect adjacent allocations or historical routing rather than definitive proof about .154.246 itself. Because of this churn, disparate tools can produce divergent operator names unless the query uses current regional registry (RIPE) data and live BGP/WHOIS lookups [4] [6] [5].
4. Practical verification steps you can perform immediately
To move from inference to authoritative attribution, run a live WHOIS lookup against RIPE for 185.213.154.246 and check current BGP announcement data (RIPEstat or a route‑views collector) to see the announcing ASN and origin AS path. Use multi‑vantage traceroutes and ping tests — ideally from European and North American probes — to confirm reachability and the last‑hop ASNs. For abuse or contact purposes, RIPEstat’s Abuse Contact Finder gives the designated abuse email for the network owner; IPinfo/IPGeolocation pages provide quick snapshots but should be corroborated with RIPE and active network probes for definitive ownership and contact details [3] [7].
5. What the available data does not show and implications for investigators
Current open probes report .246 as not pingable and lacking a resolved hostname, so there is no public evidence of a listening service or hosted domain at that exact address in the cited snapshots; this absence does not prove the IP is unused — it may be firewalled, assigned but idle, or intentionally silenced for abuse mitigation. Investigators should not equate non‑responsiveness with non‑existence; instead, combine registry data, passive DNS, and coordinated probing to determine role and recent activity. For legal or security actions, rely on RIPE/ISP contacts rather than third‑party summaries to ensure accurate attribution and up‑to‑date ownership [1] [3].
6. Bottom line and recommended next actions for authoritative confirmation
The most defensible statement today is that 185.213.154.246 belongs to the 185.213.154.0/24 block tied to AS39351 (31173 Services AB) in recent datasets, but the host is not responding to public probes in published scans. To finalize attribution, perform a live RIPE WHOIS lookup, check BGP origin via route collectors, and request passive DNS/hosting records from a reputable provider; to report abuse, use RIPEstat’s abuse contact finder to reach the network operator directly. These steps will convert secondary-tool inferences into authoritative, timestamped records suitable for operational or legal follow‑up [1] [3].