185.191.171.3
IP INTELLIGENCE BRIEFING: 185.191.171.3/32
---
**Executive Summary**
IP 185.191.171.3 is classified as Low Risk with a risk score of 25. The address belongs to ASN 209366 (Jaroslav Jacjuk) under netname SCL66-rented1 (RIPE RIR). The subnet shows minimal abuse density with all sibling IPs displaying consistent low-risk profiles.
---
**Technical Profile**
| Attribute | Value |
|---|---|
| **Risk Score** | 25 (Low Risk) |
| **ASN** | 209366 |
| **Organization** | Jaroslav Jacjuk |
| **Netname** | SCL66-rented1 |
| **CIDR** | 185.191.171.0/24 |
| **Geolocation** | GB (Limassol, Cyprus region) |
| **Operator Score** | 0.3478 (Basic) |
| **Route Stability** | Unstable |
| **DNSBL Listed** | 1 of 8 lists |
---
**DNS & Network Services**
- PTR Hostname: 3.bl.bot.semrush.com
- Forward Resolution: 3.bl.bot.semrush.com (confirmed)
- DNS Records: SPF (active), DMARC (p=quarantine)
- Open Ports: None detected
- Service Purpose: Firewalled / No Services
- Not classified as: Tor, CDN, VPN, Proxy, Hosting, Mobile
---
**Threat Indicators**
- Known Attacker: No
- Spam Source: No
- Tor Exit Node: No
- Campaign Associations: None detected
- Threat Feeds: No matches
---
**Subnet Neighborhood Analysis**
- Total Siblings: 18
- Abuse Density: 0
- Classification: Clean
- Risk Distribution: 18 low-risk, 0 medium, 0 high
- Conclusion: Subnet exhibits uniform low-risk characteristics with no threat siblings identified
---
**Relationship Graph**
- DNS Associations: 3.bl.bot.semrush.com (repeated associations)
- Network Associations: SCL66-rented1 (multiple entries)
- Total Relationships: 16
---
**Observation History**
Recent signals (July 2026) indicate:
- Consistent DNSSEC and CAA record presence
- Stable email authentication (SPF/DMARC)
- Operator score maintained at 0.3478 (Basic classification)
- No persistent malicious activity observed
- Threat observation count: 0
---
**Security Recommendations**
- Firewall Action: No blocking required; low-risk profile
- Monitoring: Standard logging sufficient
- Not Recommended for: Blocking, alerting, or enhanced scrutiny
- Note: DNS hostname "3.bl.bot.semrush.com" may warrant awareness monitoring, though current operational status appears benign
---
**Analyst Notes**
The IP resolves to Semrush infrastructure but operates in a low-risk subnet with no active services or threat indicators. The botnet-related hostname designation does not currently correlate with malicious activity. No immediate defensive action required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Jaroslav Jacjuk |
| ASN | AS209366 |
| Network Name | SCL66-rented1 |
| CIDR Block | 185.191.171.0/24 |
| RIR | RIPE |
| Country | CY |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 3.bl.bot.semrush.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 3.bl.bot.semrush.com |
🔐 DNS Hygiene
| Hygiene Score | 100% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS209366 |
| Network Prefix | 185.191.171.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 19% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 19% | 2 | 2 |
| Overall | 18% | 10 | 12 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-06-30 14:12:35 UTC |
| Last Seen | 2026-08-24 23:52:38 UTC |
| Profile Built | 2026-08-29 09:20:39 UTC |
| Data Freshness | Live |
| Signal Types | 20 |
| Total Observations | 23 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 185.191.171.3
Who owns the IP address 185.191.171.3?
185.191.171.3 is registered to Jaroslav Jacjuk. The address falls within the 185.191.171.0/24 network block. Registration is held at RIPE.
Where is 185.191.171.3 located?
Geolocation data places 185.191.171.3 in CYPRUS, Limassol, United Kingdom. The local time zone is Europe/London. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 185.191.171.3 malicious or safe?
185.191.171.3 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 185.191.171.3?
The reverse DNS (PTR) record for 185.191.171.3 is 3.bl.bot.semrush.com. This hostname is forward-confirmed, meaning it resolves back to the same address.