79.186.223.251📋 Copy

# IP Intelligence Briefing: 79.186.223.251/32

## Executive Summary

IP 79.186.223.251 is classified as Low Risk with an overall risk score of 15. The address is assigned to Orange-Swiatlowod (ASN 5617) under TP S.A. Hostmaster. Current threat indicators are minimal, with no active malicious campaigns detected. The IP is identified as a mobile carrier connection from Orange Polska S.A., operating within the 79.186.0.0/16 block.

## Ownership and Network Classification

• Organization: TP S.A. Hostmaster
• Netname: Orange-Swiatlowod
• ASN: 5617
• RIR: Ripe
• CIDR Block: 79.186.0.0/16
• Network Type: Mobile Carrier (LTE/5G)
• Carrier: Orange Polska S.A. (MCC: 260, MNC: 03)
• Service Status: Firewalled / No Services (no open ports detected)

## Geolocation Analysis

Geolocation data shows conflicting signals:

• Primary Classification: United States (US-NY)
• Secondary Classification: Poland (PL)
• GeoConsensus: False (indicates conflicting geolocation sources)
• GeoPlausible: False
• Forward Resolution: Confirmed via PTR record to 79.186.223.251.ipv4.supernova.orange.pl

## Threat Intelligence

• Risk Score: 15 (Low)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: Not available
• Blacklist Status: Listed on 1 of 8 DNSBL lists (medium severity)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Campaigns: None detected
• Threat Persistence Days: 0

## Historical Observations

17 total observations recorded. Most recent activity detected on 2026-07-27. Signal types include:

• Network classification signals
• Organization and ASN resolution
• DNS and domain association
• Blacklist monitoring (1 listing observed)

## Relationship Graph

Two primary relationships identified:

1. DNS Association: 79.186.223.251.ipv4.supernova.orange.pl

2. Same Network: Orange-Swiatlowod

## Neighborhood Analysis

• Subnet: 79.186.223.251/24
• Abuse Density: 0 (clean classification)
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0

## Recommended Actions

No specific firewall or mitigation rules generated due to low risk classification. However, the single DNSBL listing warrants periodic monitoring.

## Intelligence Assessment

This IP address represents a legitimate mobile carrier connection with minimal threat activity. The conflicting geolocation data (US vs. PL) is consistent with mobile roaming patterns. No evidence of abuse, malicious activity, or campaign association detected. The IP is properly registered with TP S.A. Hostmaster and operates within normal mobile network parameters. SOC analysts may monitor the single blacklist listing but no immediate blocking action is required.

---

*Intel generated by IPDebrief for defensive security purposes.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.