194.12.68.22
IP Intelligence Briefing: 194.12.68.22
Executive Summary
IP 194.12.68.22 presented a moderate risk profile (Score: 55) during the observation window between July 4 and September 14, 2026. Analysis indicates active web services with lighttpd/1.4.39 banner and confirmed listing on three DNS blocklists. The system recommendation was to block traffic due to elevated risk signals.
Ownership and Geolocation
The address resolved to ASN 47283, registered to Dmitry Koval (ZEUS-UA-NET1) under RIPE NCC. Geolocation data identified the origin as Kremenchuk, Poltava Oblast, Ukraine (UA). Route stability data showed zero BGP route changes over the 30-day period, though the route was marked as not stable.
Threat Indicators and Behavior
Threat indicators flagged the IP as a Blacklisted Host with a count of three DNSBL listings out of eight total checks. While the IP was not classified as a known attacker or Tor exit node, the control plane operator score remained low (0.2609). The IP was observed listening on TCP ports 80 and 443 with forward resolution confirmed to `22-68-12-194.zeus.poltava.ua`. No TLS certificates were detected, and email authentication records (SPF/DMARC) were absent.
Neighborhood and Confidence
The immediate /24 subnet (194.12.68.0/24) was classified as clean with zero threat siblings. Overall data confidence was rated as very low (0.125), indicating insufficient data to fully classify intent. Despite low confidence, the explicit recommendation action was to block based on multiple threat signals.
Recommendation
Traffic from 194.12.68.22 is to be blocked immediately. The action severity is high. Firewall rules were generated for iptables, nginx, and pf.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Dmitry Koval |
| ASN | AS47283 |
| Network Name | ZEUS-UA-NET1 |
| CIDR Block | 194.12.64.0/19 |
| RIR | RIPE |
| Country | UA |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 22-68-12-194.zeus.poltava.ua |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 22-68-12-194.zeus.poltava.ua |
🔐 DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | Web server detected |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS47283 |
| Network Prefix | 194.12.64.0/19 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 38% | 2 | 5 |
| routing | 33% | 1 | 4 |
| services | 24% | 2 | 3 |
| ownership | 17% | 2 | 3 |
| reputation | 25% | 1 | 3 |
| geolocation | 31% | 2 | 3 |
| Overall | 28% | 10 | 21 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-04 11:16:10 UTC |
| Last Seen | 2026-09-14 00:57:57 UTC |
| Profile Built | 2026-09-14 01:07:00 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 38 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 194.12.68.22
Who owns the IP address 194.12.68.22?
194.12.68.22 is registered to Dmitry Koval. The address falls within the 194.12.64.0/19 network block. Registration is held at RIPE.
Where is 194.12.68.22 located?
Geolocation data places 194.12.68.22 in Kremenchuk, Poltava Oblast, Ukraine. The local time zone is Europe/Kyiv. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 194.12.68.22 malicious or safe?
194.12.68.22 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 194.12.68.22?
The reverse DNS (PTR) record for 194.12.68.22 is 22-68-12-194.zeus.poltava.ua. This hostname is forward-confirmed, meaning it resolves back to the same address.
What ports are open on 194.12.68.22?
Responsive ports observed on 194.12.68.22 include 80, 443. Port visibility reflects the most recent scan and may change as the host's configuration or firewall rules change.