77.85.195.99📋 Copy

# IP Intelligence Briefing: 77.85.195.99/32

## Executive Summary

IP address 77.85.195.99 is registered to Bulgarian infrastructure provider BT95-ADM (ASN 8866) and presents a LOW RISK profile with a risk score of 25/100. The IP demonstrates no active threat indicators, no known malicious associations, and shows no signs of persistent malicious behavior. The address is firewalled with no active services and no open ports detected.

## Infrastructure Profile

## Threat Assessment

Risk Classification: Low Risk (Score: 25/100)

Threat Indicators:

• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Proxy: False
• Hosting Service: False
• CDN: False
• VPN: False

Control Plane Analysis:

• BGP Origin: 77.85.192.0/22
• Route Stability: False
• DNSBL Listed: 1 of 8 lists
• DNSSEC: Valid
• RPKI State: Not applicable

## Network Behavior

Services: No open ports detected. No TLS certificates, HTTP titles, or server banners observed.

DNS Resolution:

• PTR Hostname: 77-85-195-99.ip.btc-net.bg
• Forward Resolution: Confirmed
• Hosted Domains: 0

Geolocation Validation:

• Claimed Location: Sofia, Bulgaria
• Distance from Claimed Geo: 1,651.2 km
• Average RTT: 137.4 ms
• Geo Plausibility: True

## Temporal Analysis

Observation History: 18 signals observed

• Most Recent: 2026-07-30
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False

Signal Types Detected:

• Geo-location inference (Bulgaria, Sofia)
• Network scanning probes
• RTT measurements
• Ownership verification

## Network Relationships

Associated Entities:

• DNS Hostnames: 77-85-195-99.ip.btc-net.bg (2 associations)
• Network: MBPLR_Vita_Pomorie (4 associations)

No external hosting, certificate, or organizational relationships detected beyond the primary network registration.

## Subnet Analysis

Neighborhood: 77.85.195.99/24

• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0%
• Classification: Clean

No neighboring IPs in the /24 subnet show elevated risk profiles or malicious activity.

## Recommended Actions

Based on the low-risk profile and absence of threat indicators, standard defensive posture applies:

• No immediate blocking or filtering required
• Monitor for service activation on previously closed ports
• Include in baseline traffic monitoring
• No firewall rules recommended at this time

Priority: Routine monitoring - no immediate action required

---

*Intelligence generated from IPDebrief analysis. Data current as of analysis timestamp.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.