# 107.172.195.191 — IP Intelligence Summary

107.172.195.191 is an IPv4 address operated by HostPapa (AS36352), geolocated to Elk Grove Village, United States. Its reverse DNS name is 107-172-195-191-host.colocrossing.com. As of November 4, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/107.172.195.191
- Last updated: 2026-11-04

## Ownership

- Organization: HostPapa
- Network name: CC-17
- Allocated block: 107.172.0.0/14
- ASN: AS36352 (https://ipdebrief.com/asn/36352)
- Regional registry: ARIN

## Location

- City: Elk Grove Village
- Region: Illinois
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- 107-172-195-191-host.colocrossing.com
- Forward-confirmed: no

## Analyst narrative

\# IP Intelligence Briefing: 107.172.195.191

**Target:** 107.172.195.191

**Risk Classification:** Low Risk (Score: 20/100)

**ASN:** 36352 (HostPapa) | **Netname:** CC-17 | **CIDR Block:** 107.172.0.0/14

\---

\## Executive Summary

The IP 107.172.195.191 presents a low-risk profile with minimal active threat indicators. The address operates as a firewalled endpoint with no open services, though geolocation validation shows implausible coordinate claims. The subnet exhibits moderate abuse density with mixed-classification neighbors.

\---

\## Ownership and Infrastructure

The IP belongs to HostPapa (ASN 36352) within the CC-17 network block in Elk Grove Village, IL. The address resolves to the PTR hostname 107-172-195-191-host.colocrossing.com under the colocrossing.com domain. DNS configuration includes SPF and DMARC records. The IP maintains a stable control plane with DNSSEC validation but lacks route stability indicators.

\---

\## Threat Assessment

Threat indicators show no active malicious behavior. Blacklist enumeration returned zero listings across monitored feeds. The IP is not identified as a Tor exit node, known attacker, or spam source. No certificate matches or campaign correlations were detected. The overall control plane operator score was classified as "Minimal" at 0.1304.

\---

\## Geolocation Anomaly

Geolocation validation flagged implausible coordinate claims. The reported distance of 6713km from the probe location conflicts with the observed RTT of 39ms, which violates the minimum possible RTT of 134.3ms for that distance. This discrepancy indicates unreliable geolocation data or potential spoofing.

\---

\## Neighborhood Analysis

The /24 subnet 107.172.195.0/24 contains 12 sibling IPs with an abuse density of 0. Risk distribution across the subnet showed 4 medium-risk IPs (score 25-40) and 7 low-risk IPs. Inherited risk for the target IP was assessed at 15. Active sibling count was 1 with 6 threat siblings identified in the broader subnet.

\---

\## Historical Observations

Signal history recorded 20 observations. Recent activity (as of 2026-07-23) showed one blacklist listing with high severity across 8 total lists. Geolocation probes consistently flagged RTT violations. Control plane signals maintained minimal operator scores throughout the observation window.

\---

\## Recommended Actions

**Immediate:** No firewall blocking recommended. The IP presents low-risk characteristics with no active threat indicators.

**Monitoring:** Monitor for changes in blacklist status and geolocation validation. The subnet's mixed classification warrants periodic review.

**Threat Hunting:** Investigate the high-severity blacklist listing from 2026-07-23 to determine context and source.

\---

**Classification:** Defensive Security Intelligence

**Confidence Level:** Medium (based on signal coverage and geolocation validation)

## Nearby addresses

- 107.172.195.1 (https://ipdebrief.com/107.172.195.1)
- 107.172.195.3 (https://ipdebrief.com/107.172.195.3)
- 107.172.195.10 (https://ipdebrief.com/107.172.195.10)
- 107.172.195.17 (https://ipdebrief.com/107.172.195.17)
- 107.172.195.33 (https://ipdebrief.com/107.172.195.33)
- 107.172.195.114 (https://ipdebrief.com/107.172.195.114)
- 107.172.195.126 (https://ipdebrief.com/107.172.195.126)
- 107.172.195.158 (https://ipdebrief.com/107.172.195.158)
- 107.172.195.172 (https://ipdebrief.com/107.172.195.172)
- 107.172.195.201 (https://ipdebrief.com/107.172.195.201)
- 107.172.195.212 (https://ipdebrief.com/107.172.195.212)
- 107.172.195.233 (https://ipdebrief.com/107.172.195.233)

---

Source: IPDebrief, "107.172.195.191 IP intelligence", https://ipdebrief.com/107.172.195.191, updated 2026-11-04. Assessments are probabilistic.