191.96.110.78
IP Intelligence Dossier
Your IP: 216.73.216.123
🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.
IP Intelligence Briefing: 191.96.110.78
Date: 2026-06-17
---
**1. Threat Profile**
- Risk Score: 40 (Moderate Risk)
- Threat Indicators: No direct malicious activity detected (no abuse confidence, spam, or known attacker flags).
- Network Role: Firewalled infrastructure with no open services or TLS certificates.
- Geolocation: London, England, GB (high confidence, 750km accuracy radius).
---
**2. Ownership & Control Plane**
- ASN: 42831 (netutils-mnt, LACNIC registry).
- DNSSEC: Validated.
- CAA Records: Present.
- BGP: Subnet `191.96.110.0/24` with 7 sibling IPs; abuse density 28.57%.
- Routing Stability: Unstable (route changes in last 30 days).
---
**3. Observation History**
- Latest Activity: June 17, 2026 (signal confidence: 60%).
- Key Trends:
- Moderate risk persistence (40 score) with no escalation.
- DNSSEC and CAA records consistently reported.
- Two DNSBL listings (2/8 total lists) with "high" severity.
---
**4. Network Relationships**
- Linked Networks: Repeated associations with "HEFICED" (likely a typo or internal network identifier).
- DNS Associations: Points to internal IPs (e.g., `192.168.2.108`), suggesting misconfigured DNS or internal testing.
- Subnet Neighbors (191.96.110.0/24):
- High-Risk Neighbor: 191.96.110.39 (score: 65).
- Moderate-Risk Neighbors: 191.96.110.70, 191.96.110.96, 191.96.110.113 (scores: 40).
---
**5. Recommendations**
- Monitor Subnet: Focus on 191.96.110.39 and other high-risk neighbors for anomalous behavior.
- Investigate DNS Configuration: Validate DNSSEC/CAA records and resolve internal IP associations.
- Check Network Link: Investigate "HEFICED" network ties for potential misconfigurations or compromised infrastructure.
- Baseline Activity: No immediate action required for 191.96.110.78, but maintain surveillance due to subnet risk density.
---
Source: IPDebrief Threat Intelligence Platform
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | netutils-mnt |
| ASN | AS42831 |
| Network Name | — |
| CIDR Block | — |
| RIR | LACNIC |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 3389 | rdp | tcp | — |
| Closed Ports | 22, 25, 80, 443, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
No certificate
Issued by —
N/A
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 2 | 4 |
| routing | 13% | 1 | 1 |
| services | 24% | 2 | 3 |
| ownership | 20% | 2 | 3 |
| reputation | 21% | 1 | 3 |
| geolocation | 19% | 2 | 2 |
| Overall | 20% | 10 | 16 |
Coverage: 6/6 dimensions · Data sufficiency: sufficient
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ Geo sources disagree on country: US, GB
📅 Observation Timeline 🔄 Live
| First Seen | 2026-05-07 23:04:03 UTC |
| Last Seen | 2026-06-23 02:36:47 UTC |
| Profile Built | 2026-06-23 02:44:37 UTC |
| Data Freshness | Live |
| Signal Types | 22 |
| Total Observations | 24 |
🔍 22 signal types · 24 observations collected
This report is generated from 22+ independent intelligence signals including
ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds,
behavioral fingerprinting, and more.
Full dossier details are available via our API.
Full dossier details are available via our API.
ℹ️ About This Report
All data shown is publicly available network metadata — IP addresses do not reliably identify individuals.
Assessments are probabilistic and should not be used as sole basis for access control decisions.
To report an issue or request data review, contact admin@ipdebrief.com.