195.239.183.246📋 Copy

# IP Intelligence Briefing: 195.239.183.246

## Executive Summary

IP address 195.239.183.246 is classified as High Risk with a risk score of 70/100. The address is associated with Russian infrastructure (ASN 3216, SOVINTEL-MNT) and exhibits multiple threat indicators including DNS blacklist listings and historical abuse signals.

## Profile Overview

Risk Assessment:

• Risk Score: 70/100
• Reputation: High Risk
• Classification: Firewalled / No Services
• Operator Score: 0.1304 (Minimal)

Network Ownership:

• ASN: 3216 (PJSC Vimpelcom)
• Organization: SOVINTEL-MNT
• RIR: RIPE
• CIDR Block: 195.239.0.0/16

Geolocation:

• Country: Russia (RU)
• Region: Multiple sources indicate varying locations (Vladivostok, KRS)
• Accuracy Radius: 5000km
• Geo Consensus: Validated

## Threat Indicators

DNS Blacklist Status:

• Listed on 4 DNS blacklists out of 8 total lists
• Maximum Severity: High
• Lists include: Multiple abuse feeds with high-severity ratings

Historical Signals:

• 22 total observations recorded
• Recent activity (June 2026): Threat indicators present with multiple pulse associations
• DNS blacklist activity observed: 6+ listings detected

Network Behavior:

• No open ports detected
• Tor exit: No
• Known attacker: No
• Spam source: No
• Proxy/VPN: No

## Relationship Analysis

Network Associations:

• Primary network: RU-SOVINTEL-KRS-Static-IP-Pool-NET
• Multiple connections to same static IP pool network
• 38 total relationships identified

Neighborhood Assessment:

• Subnet: 195.239.183.0/24
• Abuse Density: 1 (Low)
• Classification: Mostly Clean
• Threat Siblings: 1 detected within /24

## Recommended Actions

Immediate Mitigation:

Operational Recommendations:

1. Increase logging verbosity for all traffic from this IP

2. Review recent activity logs for correlation with other threat indicators

3. Monitor ASN 3216 for additional malicious activity

4. Consider blocking entire subnet 195.239.183.0/24 if abuse density warrants

## Intelligence Notes

The IP demonstrates consistent threat behavior with DNS blacklist presence and historical abuse signals. No active services are running (firewalled), suggesting the address may be used for command-and-control or scanning operations. The association with the SOVINTEL-MNT network indicates potential institutional origin.

Confidence Level: High

Data Sources: Multiple threat feeds, DNS blacklists, historical observations

Last Updated: Current intelligence cycle

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.