85.208.96.195📋 Copy

# IP Intelligence Briefing: 85.208.96.195

## Executive Summary

IP address 85.208.96.195 is classified as Low Risk (Risk Score: 25) with no active threat indicators. The address resolves to semrush.com infrastructure and operates as a firewalled endpoint with no exposed services. Neighborhood analysis indicates a predominantly clean subnet environment.

## Profile Overview

• Risk Score: 25 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• ASN: AS209366
• Organization: Albert Valiev
• Network Name: crawlers
• Registration: RIPE
• CIDR Block: 85.208.96.0/24
• Geolocation: United States, Virginia, Ashburn (37.43°N, -78.66°W)

## DNS & Network Identity

• PTR Hostname: 195.bl.bot.semrush.com
• Associated Domain: semrush.com
• DNS Classification: Forward confirmed
• Email Authentication: SPF and DMARC records present
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None

## Threat Assessment

• Abuse Confidence Score: Not applicable
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Threat Feeds: No matches
• DNSBL Status: Listed on 1 of 8 threat lists

## Network Context

• Subnet Classification: mostly_clean
• Abuse Density: 0.1 (10%)
• Inherited Risk: 4
• Total Subnet Siblings: 20
• Active Siblings: 7
• Threat Siblings: 2
• Risk Distribution (Neighbors): 19 low risk, 0 medium, 0 high

## Relationship Graph

The IP maintains multiple associations with:

• DNS Hostnames: 195.bl.bot.semrush.com (11 relationships)
• Network: crawlers (4 relationships)

## Historical Analysis

Eighteen observations recorded. Recent signals include:

• 2026-07-23: Multiple signals detected including semrush.com DNS resolution (confidence: 0.80) and AS209366 routing information (confidence: 0.95)
• Geolocation: Consistent US-based placement with Virginia coordinates
• Threat Signals: One observation indicated threat presence with 50 pulse associations

## Recommended Actions

No immediate blocking or mitigation actions recommended. The IP demonstrates characteristics of legitimate infrastructure:

• Firewalled endpoint with no accessible services
• Associated with known enterprise domain (semrush.com)
• Low-risk neighborhood profile
• No active threat indicators or known campaigns

## Intelligence Note

This IP operates as crawler infrastructure for Semrush, a legitimate SEO and digital analytics platform. The /24 subnet maintains a low-abuse environment with minimal threat presence. No defensive action required; standard monitoring practices apply.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.