195.128.99.54📋 Copy

# IP Intelligence Briefing: 195.128.99.54/32

## Executive Summary

The target IP address 195.128.99.54 operates within a high-risk profile (risk score: 80/100) attributed to Intal Alliulin's RU-SKYNETWORK1-20180807 network infrastructure in Kazan', Tatarstan Republic, Russia. Despite showing no active service exposure, the IP maintains elevated threat indicators including DNSBL listings and route instability.

## Ownership and Network Classification

• Organization: Intal Alliulin
• ASN: 31566
• Network Block: 195.128.96.0/22
• CIDR Assignment: 195.128.99.54/24
• Geolocation: Kazan', Tatarstan Republic, Russia (RU)
• RIR: RIPE
• Registration: 2018-08-07

## Risk Assessment

• Overall Risk Score: 80/100 (High Risk)
• Network Reputation: High Risk
• DNSBL Status: Listed on 6 of 8 total DNSBL feeds
• Service Exposure: None detected (firewalled/no services)
• Open Ports: Empty
• Infrastructure Type: Non-residential, non-cloud infrastructure

## Behavioral Indicators

• Route Stability: False (route changes detected)
• Operator Score: 0.1304 (Minimal)
• Tor/Proxy/VPS: Not classified as any of these
• Email Authentication: No SPF, DMARC, or TXT records detected
• DNS Resolution: No forward resolution confirmed

## Observation History

Analysis of 16 historical observations reveals the following patterns:

• Geolocation: Consistent RU classification with geo-plausible validation
• Connectivity: ICMP probes blocked (unable to validate)
• Last Observed: 2026-07-31T02:12:12+00:00
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0 (stable ownership)

## Relationship Graph

Three relationship entries identified, all pointing to the same network identifier: RU-SKYNETWORK1-20180807. No connections to external subnets, hostnames, or organizations detected beyond the primary network assignment.

## Neighborhood Analysis

Subnet 195.128.99.0/24 shows:

• Total Siblings: 1
• Active Siblings: 0
• Abuse Density: 0%
• Threat Siblings: 0
• Classification: Clean
• Inherited Risk: 0

No neighboring IPs with elevated risk profiles detected within the /24 subnet.

## Recommended Security Actions

Immediate Mitigation

Monitoring Recommendations

• Increase logging verbosity for traffic from this IP
• Review recent activity logs for any interaction attempts
• Monitor for emergence of open services on this address
• Track for changes in network behavior or route announcements

## Intelligence Narrative

This IP address represents a dormant but classified high-risk asset. The elevated risk score (80/100) combined with DNSBL listings suggests historical abuse activity, though no active malicious services are currently exposed. The network classification as "firewalled/no services" indicates the IP may be reserved, administrative, or intentionally obscured. Route instability flags warrant ongoing monitoring for infrastructure changes. The absence of neighboring threats within the /24 subnet suggests isolated risk rather than a coordinated infrastructure. SOC analysts should maintain blocking posture while monitoring for service emergence or behavioral changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.