191.101.157.18📋 Copy

# IP Intelligence Briefing: 191.101.157.18

Classification: Low Risk Infrastructure Address

Report Date: 2026-07-28

Risk Score: 15/100

---

## Executive Summary

IP address 191.101.157.18 is classified as low risk with minimal threat indicators. The address belongs to the IPXO network block under Cogent Communications (ASN 174) and shows no evidence of malicious activity. The subnet exhibits low abuse density, and the target IP is firewalled with no active services.

---

## Network Ownership & Geolocation

• ASN: 174 (COGENT-174 - Cogent Communications, LLC, US)
• Organization: netutils-mnt / IPXO
• CIDR Block: 191.101.128.0/17
• RIR: LACNIC
• Registration Date: 2014-03-13
• Geolocation: London, GB (Region: State of Berlin) — *Note: Geographic consensus inconsistent across signal sources*

---

## Threat Assessment

• Reputation: Low Risk
• Blacklist Count: 0
• Abuse Confidence: Not applicable (no abuse indicators)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Threat Feeds: None detected
• Campaign Affiliations: None identified

DNSBL Status: Listed on 1 of 8 checked lists (medium severity)

---

## Technical Profile

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• DNS Resolution: No forward resolution confirmed
• PTR Records: None
• DNSSEC: Valid
• Control Plane: Route stability flag is false; RPKI state and IRR consistency not resolved

---

## Neighborhood Analysis

Subnet: 191.101.157.0/24

Total Siblings: 11

Abuse Density: 0

Risk Distribution:

• High Risk: 0
• Medium Risk: 2
• Low Risk: 9

Notable Neighbors:

• 191.101.157.28 (Risk: 55)
• 191.101.157.94 (Risk: 40)
• Remaining 9 siblings: Risk score 25

---

## Observation History

Fourteen signals observed. Key recent observations (2026-07-28):

• Port Scanning: Multiple ports scanned (confidence 0.70)
• Blacklist Listings: 8 total lists checked, 1 listing with medium severity (confidence 0.85)
• DNSSEC: Validated (confidence 0.90)
• ASN Resolution: COGENT-174 (confidence 0.85)
• Geolocation: Inferred US location (confidence 0.28) — *low confidence*

Temporal Indicators:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 0
• Persistently malicious: No

---

## Relationships

• Same Network: IPXO (2 relationships detected)
• No external entity relationships (hostnames, organizations, certificates) identified

---

## Recommended Actions

No immediate security actions required. The IP presents a low-risk profile with no active threat indicators. However, the subnet contains two medium-risk neighbors (191.101.157.28, 191.101.157.94) that warrant periodic monitoring.

Monitoring Recommendations:

• Track the medium-risk neighbors for escalation
• Monitor for changes in DNSBL status
• Maintain awareness of subnet activity given mixed risk distribution

---

Analyst Notes: The geographic data shows inconsistency (GB vs US in different signal sources), suggesting potential data quality issues. The IP's firewall status with no open services reduces its utility for malicious purposes. The single DNSBL listing requires tracking but does not indicate current threat activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.