147.90.209.31📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target IP: 147.90.209.31/32

Date: 2026-07-31

Classification: Moderate Risk - Consumer VPN Endpoint

## Executive Summary

IP 147.90.209.31 is identified as a consumer VPN endpoint located in Frankfurt am Main, Germany (Hesse region). The IP belongs to ASN 212238 (FRANKFURT-AM-MAIN-DE-147-90-209-0) and carries a risk score of 50/100 (Moderate Risk). No active threat indicators, blacklist entries, or open services were detected. The IP is firewalled with no reachable services.

## Ownership and Geolocation

• ASN: 212238
• Organization: VPN Consumer Frankfurt, Germany
• Network: 147.90.209.0/24
• Country: Germany (DE)
• City: Frankfurt am Main
• Coordinates: 51.62°N, 8.04°E
• Geolocation Confidence: Plausible (consensus from multiple sources)
• Geographic Validation: RTT measurements (101-104ms) consistent with Frankfurt location

## Threat Intelligence Assessment

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: 0/0 blacklist entries
• Threat Indicators: None detected
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Network Role and Services

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNS Records: No PTR hostnames, no forward resolution
• TLS/HTTP Services: None exposed
• Cloud/CDN/Hosting: Not identified

## Control Plane Analysis

• Route Stability: Stable
• DNSBL Listings: 2/8 total lists
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated
• IRR Consistency: Not assessed

## Neighborhood Analysis

Subnet: 147.90.209.0/24

• Total Neighbors: 37
• Abuse Density: 0
• Risk Distribution: 0 High, 3 Medium, 34 Low
• Notable Neighbors:

- 147.90.209.136: Risk Score 65 (Elevated)

- Multiple neighbors with risk scores 25-50

## Observation History

• Total Observations: 12 signals
• Recent Activity: Geo and RTT signals observed 2026-07-31
• Geographic Consistency: Frankfurt am Main, Germany (consistent across observations)
• Threat Persistence: 0 days
• Ownership Changes: 0

## Recommended Actions

Based on the moderate risk profile and firewalled status:

1. No immediate blocking required - no active threat indicators

2. Monitor the IP for service exposure if previously firewalled

3. Track 147.90.209.136 in the same subnet (risk score 65) for potential coordinated activity

4. Standard VPN traffic policies apply - no special firewall rules needed

## Threat Narrative

The IP address 147.90.209.31 represents a consumer VPN endpoint in Frankfurt, Germany. The moderate risk score (50) reflects VPN classification rather than malicious activity. No threat intelligence indicates attacker association or campaign participation. The subnet shows low abuse density with scattered medium-risk neighbors, suggesting this is a consumer-grade VPN pool rather than an abuse-focused infrastructure. Monitoring should focus on subnet-wide activity, particularly IP 147.90.209.136 which exhibits elevated risk scoring.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.