185.191.171.14📋 Copy

# IP Intelligence Briefing: 185.191.171.14

## Executive Summary

The IP address 185.191.171.14 presents a low-risk profile with no active threat indicators. The address resolves to Semrush infrastructure and operates within a clean /24 subnet with zero abuse density. No malicious campaigns or persistent threat activity observed.

---

## Risk Assessment

Overall Risk Score: 25 (Low Risk)

Reputation Classification: Low Risk

Abuse Confidence Score: Not applicable (no active threats detected)

The IP maintains a stable operational profile with no evidence of malicious activity. Risk breakdown indicates minimal provider, authority, and stability concerns.

---

## Ownership and Network Classification

• ASN: 209366
• Organization: Jaroslav Jacjuk
• Netname: SCL66-rented1
• RIR: RIPE
• ASN Registration: 2019-02-21 (2,688 days old)
• CIDR Block: 185.191.171.0/24
• Routing Stability: Route stable with no 30-day route changes
• RPKI State: Valid
• IRR Consistency: Consistent

---

## Geolocation

• Reported Country: GB (United Kingdom)
• ASN Country: CY (Cyprus)
• Region/City: Cyprus, Limassol
• Timezone: Europe/London
• Geolocation Accuracy: 500km radius

*Note: Discrepancy between reported country (GB) and ASN registration country (CY) detected.*

---

## DNS and Service Profile

• PTR Hostname: 14.bl.bot.semrush.com
• Forward Resolution: 14.bl.bot.semrush.com (semrush.com)
• Services: Firewalled / No Services (no open ports)
• TLS Certificates: None detected
• Email Authentication: SPF and DMARC records present
• DNSBL Status: Listed on 1 of 8 total lists

---

## Threat Indicators

• Threat Indicators: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Known Campaigns: None
• Campaign Likelihood: Not applicable

---

## Neighborhood Analysis (185.191.171.0/24)

• Total Siblings: 15
• Active Siblings: 9
• Threat Siblings: 0
• Abuse Density: 0 (Clean)
• Subnet Classification: Clean

Risk distribution across neighborhood: 0 high-risk, 1 medium-risk, 17 low-risk IPs. The subnet demonstrates consistent benign behavior with no inherited risk from adjacent addresses.

---

## Relationship Graph

The IP maintains associations with:

• DNS Associations: Multiple links to 14.bl.bot.semrush.com
• Network Associations: Multiple links to SCL66-rented1 network
• No Cross-Entity Relationships: No associations with other organizations, countries, or certificate authorities detected

---

## Historical Observation Summary

• Total Observations: 20 signals collected
• Latest Data: 2026-07-22
• Observation Types: DNS resolution, geolocation, control plane, ASN registration
• Threat Persistence: 0 days (no persistent malicious activity)
• Ownership Changes: 0

Historical signals indicate stable DNS behavior with consistent semrush.com resolution. ASN registration age and control plane stability support the low-risk classification.

---

## Recommended Actions

No immediate security actions recommended.

The IP address demonstrates clean operational characteristics:

• No firewall rules required
• No WAF policies needed
• No blocking actions indicated
• No certificate revocation requests necessary

---

## Intelligence Narrative

IP 185.191.171.14 operates within the Semrush ecosystem as a bot service node. The address maintains consistent DNS resolution to semrush.com infrastructure with no evidence of command-and-control activity or malicious behavior. The subnet exhibits zero abuse density, indicating coordinated benign operations. No correlation with known threat campaigns or attacker infrastructure detected. The IP may be legitimately utilized for marketing, SEO, or web analytics services. SOC analysts may safely whitelist this address for incoming traffic, though outbound traffic monitoring remains appropriate for compliance purposes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.