# 194.195.91.60 — IP Intelligence Summary

194.195.91.60 is an IPv4 address operated by netutils-mnt (AS206092), geolocated to Stockholm, Germany. As of August 29, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/194.195.91.60
- Last updated: 2026-08-29

## Ownership

- Organization: netutils-mnt
- Network name: IPXO
- Allocated block: 194.195.91.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: Stockholm
- Region: Stockholm County
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target:** 194.195.91.60/32

**Classification:** Low Risk Infrastructure Node

**Report Date:** 2026-07-24

**Analyst:** IPDebrief Intelligence Platform

\---

\## EXECUTIVE SUMMARY

The target IP address 194.195.91.60 presents a **Low Risk** profile (Risk Score: 25) with no active threat indicators. The address belongs to the IPXO network block (194.195.91.0/24) operated by netutils-mnt under RIPE NCC registration. The IP is currently firewalled with no open services, resulting in no exploitable attack surface. No malicious campaigns, known attacker associations, or spam source designations have been identified.

\---

\## RISK ASSESSMENT

| Metric | Value | Assessment |

|--------|-------|------------|

| **Risk Score** | 25 | Low Risk |

| **Provider Score** | 0 | Standard |

| **Authority Score** | 0 | Standard |

| **Abuse Confidence** | N/A | Not Applicable |

| **Blacklist Count** | 0 | Clean |

| **DNSBL Listed** | 1/8 lists | Minimal |

| **Operator Score** | 0.1304 | Minimal |

\---

\## NETWORK OWNERSHIP & GEOLOCATION

**Origin:** ASN 206092 (netutils-mnt)

**Netname:** IPXO

**CIDR:** 194.195.91.0/24

**RIR:** RIPE

**Geolocation Discrepancy:** Geo records show Stockholm County, Germany (DE), but historical observations indicate Turkey (TR). This geographic inconsistency warrants monitoring but does not currently impact risk posture.

**Contact:** Abuse reporting available via RDAP (report@abuseradar.com)

\---

\## THREAT INDICATORS

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Tor Exit Node:** No

\- **CDN/Cloud/Proxy:** No

\- **Active Threat Feeds:** None

\- **Known Campaigns:** None

\- **Signal History:** 16 observations with no persistent malicious activity detected

**Behavioral Analysis:**

\- Honeypot Hits: 0

\- Enumeration Strikes: 0

\- WAF Violations: 0

\- Total Incidents: 0

\- Persistently Malicious: No

\---

\## NEIGHBORHOOD ANALYSIS (194.195.91.0/24)

**Subnet Risk Profile:**

\- **Total Siblings:** 44

\- **Active Siblings:** 0

\- **Threat Siblings:** 5

\- **Abuse Density:** 0.1136 (Low)

\- **Overall Classification:** Mostly Clean

**Risk Distribution:**

\- High Risk: 0

\- Medium Risk: 0

\- Low Risk: 43

The /24 subnet shows minimal abuse activity with risk scores predominantly at 0-25. Only 5 sibling IPs carry the same elevated risk score (25) as the target, suggesting isolated rather than coordinated activity.

\---

\## NETWORK SERVICES & INFRASTRUCTURE

\- **Open Ports:** None (Firewalled)

\- **DNS Resolution:** Not confirmed

\- **PTR Records:** None

\- **Hosted Domains:** 0

\- **TLS/Certificates:** None

\- **HTTP Services:** None detected

**Control Plane Data:**

\- BGP Prefix: 194.195.91.0/24

\- Route Stability: Not stable

\- 30-Day Route Changes: 0

\- DNSSEC Valid: Yes

\- RPKI State: Not assessed

\---

\## OBSERVATION HISTORY

Recent signal observations (16 total) show:

\- **Abuse Density:** 0.1136 (consistently low)

\- **Classification:** Mostly Clean

\- **Inherited Risk:** 4

\- **Ownership Changes:** 0

The IP has demonstrated behavioral stability with no escalation in risk posture over the observation period.

\---

\## SECURITY RECOMMENDATIONS

**Action:** No immediate firewall rules required. The IP presents minimal threat.

**Standard Practice:**

\- Monitor for service changes (currently firewalled)

\- Continue geographic consistency verification (DE/TR discrepancy)

\- Review sibling IPs if future threats emerge in /24

**Alert Thresholds:**

\- Risk Score \> 50: Investigate

\- Service changes: Monitor

\- Geographic shift: Verify

\- Sibling IP threats: Escalate

\---

\## CONCLUSION

IP 194.195.91.60 is a low-risk infrastructure node with no active malicious indicators. The network shows minimal abuse density and the target IP is currently firewalled. No immediate blocking or monitoring escalation is warranted. Standard monitoring practices recommended.

**Status:** CLEAR FOR ROUTE (No Action Required)

## Nearby addresses

- 194.195.91.1 (https://ipdebrief.com/194.195.91.1)
- 194.195.91.2 (https://ipdebrief.com/194.195.91.2)
- 194.195.91.4 (https://ipdebrief.com/194.195.91.4)
- 194.195.91.5 (https://ipdebrief.com/194.195.91.5)
- 194.195.91.6 (https://ipdebrief.com/194.195.91.6)
- 194.195.91.7 (https://ipdebrief.com/194.195.91.7)
- 194.195.91.8 (https://ipdebrief.com/194.195.91.8)
- 194.195.91.9 (https://ipdebrief.com/194.195.91.9)
- 194.195.91.11 (https://ipdebrief.com/194.195.91.11)
- 194.195.91.12 (https://ipdebrief.com/194.195.91.12)
- 194.195.91.13 (https://ipdebrief.com/194.195.91.13)
- 194.195.91.14 (https://ipdebrief.com/194.195.91.14)

---

Source: IPDebrief, "194.195.91.60 IP intelligence", https://ipdebrief.com/194.195.91.60, updated 2026-08-29. Assessments are probabilistic.