45.91.20.112📋 Copy

# IP Intelligence Briefing: 45.91.20.112/32

## Executive Summary

IP address 45.91.20.112 is classified as Low Risk with a risk score of 25/100. The address belongs to m247 ltd (ASN 9009), a consumer ISP in Milan, Italy. No active threat indicators detected. The IP shows minimal security posture concerns and represents typical residential/ISP infrastructure.

## Ownership and Geolocation

## Network Classification

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• Proxy/VPN/CDN: Not classified as proxy, VPN, CDN, or hosting infrastructure
• Anycast: No
• Bogon: No

## Threat Assessment

## Control Plane Analysis

• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 45.91.20.0/24
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated
• IRR Consistency: Not available
• Route Changes (30d): 0
• DNSSEC: Valid
• Delegation Age: Not available

## Neighborhood Analysis (45.91.20.0/24)

All neighboring IPs in the /24 subnet exhibit consistent risk scores (0 or 25) with authority scores of 50, indicating stable infrastructure behavior.

## Historical Observations

Observation Count: 19 signals

• Most Recent: 2026-06-23 14:04:57 UTC (Banner signals, confidence 0.30)
• Previous: 2026-06-18 (Subnet classification, geolocation, operator scoring)
• Threat Persistence: 0 days
• Ownership Changes: 0

Historical trend shows consistent low-risk behavior with no escalation in threat activity.

## Relationship Graph

Total Relationships: 18

• All relationships classified as "Same Network" (MILAN-IT-45-91-20-0)
• No cross-network, organizational, or hostname relationships detected
• No certificate or domain associations found

## Recommended Actions

Classification: Routine monitoring recommended. No immediate blocking required.

Firewall/IPS Rules:

• No blocking recommended for this IP
• Monitor for behavior change if threat indicators emerge
• Subnet-level reputation is stable and clean

SOC Guidance: This IP represents standard ISP infrastructure with no malicious indicators. The single DNSBL listing appears to be a false positive or historical artifact. The IP is not associated with known threat campaigns or attacker infrastructure.

---

*Intelligence compiled from IPDebrief® threat intelligence platform. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.