# 185.251.19.90 — IP Intelligence Summary

185.251.19.90 is an IPv4 address operated by lir-cy-tkbytech1-1-MNT (AS206092), geolocated to New York, United States. As of August 29, 2026, IPDebrief rates it Moderate Risk (60/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/185.251.19.90
- Last updated: 2026-08-29

## Ownership

- Organization: lir-cy-tkbytech1-1-MNT
- Network name: CY-TKBYTECH1-20210909
- Allocated block: 185.251.19.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: New York
- Region: US-NY
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (60/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 185.251.19.90/32

\## Executive Summary

IP 185.251.19.90 presents a moderate risk profile (Score: 60) with minimal operational activity. The address is part of a relatively clean subnet (185.251.19.0/24) with zero abuse density and no confirmed malicious campaigns. Primary concerns include a single DNSBL listing and one observed honeypot hit.

\## Network Classification & Ownership

\- **ASN:** 206092

\- **Organization:** lir-cy-tkbytech1-1-MNT

\- **Network Name:** CY-TKBYTECH1-20210909

\- **RIR:** RIPE

\- **CIDR Block:** 185.251.19.0/24

\- **Abuse Contact:** Available via RDAP

\- **Geolocation:** US (New York, NY) per probe data; organizational registration indicates Cyprus

\- **Network Role:** Firewalled / No Services

\## Threat Indicators

\- **Risk Score:** 60 (Moderate)

\- **Abuse Confidence Score:** Not available

\- **DNSBL Listed:** 1 of 8 total lists

\- **Blacklist Count:** 0

\- **Tor Exit:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Honeypot Hits:** 1

\- **WAF Violations:** 0

\- **Known Campaigns:** None detected

\- **Cert Matches:** 0

\## Operational Status

\- **Open Ports:** None detected

\- **Active Services:** None

\- **TLS Certificates:** None

\- **DNS Records:** No forward resolution; no PTR records

\- **Email Auth:** SPF, DMARC, and TXT records absent

\- **HTTP Indicators:** No HSTS, CSP, or HTTP/2 headers detected

\- **Server Fingerprint:** No identifiable server signature

\## Subnet Neighborhood Analysis (185.251.19.0/24)

\- **Abuse Density:** 0 (Clean classification)

\- **Total Siblings:** 5

\- **Active Siblings:** 0

\- **Threat Siblings:** 0

\- **Risk Distribution:** High: 0, Medium: 2, Low: 2

| Neighbor IP | Risk Score | Authority Score |

|-------------|------------|-----------------|

| 185.251.19.13 | 60 | 50 |

| 185.251.19.42 | 60 | 50 |

| 185.251.19.77 | 0 | 50 |

| 185.251.19.133 | 25 | 50 |

Two neighboring IPs (185.251.19.13, 185.251.19.42) share the same moderate risk score of 60.

\## Temporal Behavior & Persistence

\- **Ownership Changes:** 0

\- **Threat Persistence Days:** 0

\- **Threat Observation Count:** 0

\- **Persistently Malicious:** No

\- **Route Stability:** False

\- **Route Changes (30d):** 0

\- **Observations:** 15 total signals recorded

Recent observation history (2026-07-25) confirms consistent network registration with no ownership transitions or emerging threat patterns.

\## Recommended Actions

Based on the moderate risk profile and minimal activity, the following actions are recommended:

1. **Monitoring:** Continue observation; IP shows no active malicious behavior

2. **Firewall Rules:** Implement rate limiting or connection throttling if traffic patterns indicate abuse

3. **DNSBL Review:** Investigate the single DNSBL listing for context (source and reason)

4. **Neighbor Correlation:** Monitor medium-risk neighbors (185.251.19.13, 185.251.19.42) for coordinated activity

\## Final Assessment

IP 185.251.19.90 is classified as moderate risk primarily due to DNSBL presence and one honeypot hit. The subnet demonstrates clean characteristics with no active malicious siblings. No immediate blocking required; maintain monitoring posture and investigate the DNSBL listing for operational context.

\---

*Data sources: IPDebrief Intelligence Platform | Generated: 2026-07-25*

## Nearby addresses

- 185.251.19.9 (https://ipdebrief.com/185.251.19.9)
- 185.251.19.10 (https://ipdebrief.com/185.251.19.10)
- 185.251.19.13 (https://ipdebrief.com/185.251.19.13)
- 185.251.19.14 (https://ipdebrief.com/185.251.19.14)
- 185.251.19.15 (https://ipdebrief.com/185.251.19.15)
- 185.251.19.23 (https://ipdebrief.com/185.251.19.23)
- 185.251.19.27 (https://ipdebrief.com/185.251.19.27)
- 185.251.19.29 (https://ipdebrief.com/185.251.19.29)
- 185.251.19.30 (https://ipdebrief.com/185.251.19.30)
- 185.251.19.33 (https://ipdebrief.com/185.251.19.33)
- 185.251.19.42 (https://ipdebrief.com/185.251.19.42)
- 185.251.19.77 (https://ipdebrief.com/185.251.19.77)

---

Source: IPDebrief, "185.251.19.90 IP intelligence", https://ipdebrief.com/185.251.19.90, updated 2026-08-29. Assessments are probabilistic.