109.226.131.248📋 Copy

# IP Intelligence Briefing: 109.226.131.248/32

## Executive Summary

IP address 109.226.131.248 is a low-risk residential/cable connection assigned to SWS HOSTMASTER (Stadtwerke Schwedt, Germany). The IP has no active threat indicators, maintains stable ownership, and operates within a clean subnet. No immediate defensive action is required.

## Ownership and Network Classification

• ASN: 61028
• Organization: SWS HOSTMASTER
• Network Name: STADTWERKE-SCHWEDT-NET
• CIDR Block: 109.226.128.0/20
• Geolocation: Schwedt, Brandenburg, Germany (DE)
• Registration: ARIN registry

The IP is a municipal cable provider connection with forward-resolved hostname 109-226-131-248.cable.swschwedt.net. The network role classification indicates "Firewalled / No Services" with no open ports detected.

## Threat Assessment

• Risk Score: 15 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNS blacklist sources
• Threat Indicators: None detected
• Known Campaigns: None
• Is Tor Exit/Attacker/Spam Source: False

## Network Neighborhood Analysis

The /24 subnet (109.226.131.0/24) is classified as clean with zero abuse density. Analysis of 2 sibling IPs revealed:

• 109.226.131.248: Risk score 15 (subject IP)
• 109.226.131.93: Risk score 25, Authority score 60

The single neighbor IP exhibits elevated risk metrics but remains within acceptable bounds for a residential cable provider network.

## Historical Observations

Analysis of 15 historical observations indicates stable network behavior:

• Ownership Changes: 0 (stable assignment)
• Threat Persistence Days: 0 (no persistent malicious activity)
• Recent Observations: 2026-07-27 timeframe confirmed consistent geolocation and ownership data
• Threat Observation Count: 0

The IP has not demonstrated persistent malicious behavior and maintains consistent registration details across observation windows.

## DNS and Service Analysis

• PTR Record: 109-226-131-248.cable.swschwedt.net
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF and DMARC records not configured (expected for residential cable IP)
• Open Ports: None detected
• TLS/HTTP Services: Not detected

## Recommended Actions

No immediate firewall or blocking actions are recommended. The IP presents a low-risk profile consistent with residential/cable provider infrastructure. If observed as a source of traffic, standard logging and monitoring practices apply.

---

*This briefing is based on IPDebrief intelligence data. Analysts should correlate with additional threat intelligence sources before making defensive decisions.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.