195.250.91.222📋 Copy

# IP Intelligence Briefing: 195.250.91.222/32

Date: July 2026

Classification: LOW RISK - No Immediate Action Required

Threat Score: 25/100

---

## Executive Summary

IP address 195.250.91.222 presents a low-risk security posture with a reputation score of 25/100. The address is classified as "clean" within its /24 subnet and shows no active threat indicators. The IP is associated with network infrastructure provider GNC Admin Role (ASN 49800) and is currently firewalled with no open services. No immediate firewall blocking is recommended.

---

## Ownership & Network Attribution

---

## Threat Intelligence Assessment

Current Risk Profile

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Status: Not listed on major threat feeds

Control Plane Analysis

• BGP Prefix: 195.250.64.0/19
• Route Stability: Not stable (0 route changes in 30 days)
• DNSSEC: Valid
• DNSBL Listings: 1 listing across 8 total lists (severity: high)

---

## Neighborhood Analysis

Subnet: 195.250.91.0/24

Abuse Density: 0 (Clean)

Total Siblings: 1

Active Threat Siblings: 0

The /24 subnet exhibits minimal activity with no neighboring IPs flagged as malicious. The subnet classification is "clean" with zero inherited risk from adjacent addresses.

---

## Observation History

Total Observations: 15 signals recorded

Recent Activity (July 23, 2026):

• Network classification signals showing clean status
• ASN attribution to GNC-ALFA (country code: AM)
• DNSSEC validation confirmed
• Multiple blacklist listings detected

Temporal Indicators:

• Ownership persistence: Stable
• Threat persistence: 0 days
• Malicious persistence: False
• Total incidents: 0

---

## Infrastructure Services

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Hosted Domains: 0
• Email Authentication: No SPF/DMARC records found

---

## Recommended Actions

Current Status: NO ACTION REQUIRED

The IP address 195.250.91.222 is not associated with active malicious activity. No firewall rules, WAF configurations, or blocking actions are currently recommended. The IP should be monitored as part of routine threat intelligence operations.

---

## SOC Analyst Notes

1. Low Confidence Signals: Some observations show conflicting geolocation data (US vs AM), suggesting potential data quality issues in the control plane.

2. DNSBL Listing: Despite low risk score, 1 high-severity blacklist listing was detected. Investigate if this relates to historical activity.

3. Route Stability: BGP route shows instability (isRouteStable: false), warranting periodic re-evaluation.

4. No Active Services: The "firewalled/no services" classification suggests this may be a customer-facing IP with backend protection.

Priority: LOW

Review Frequency: Quarterly monitoring recommended

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.