85.208.96.204
IP INTELLIGENCE BRIEFING: 85.208.96.204
Date: 2026-07-22
Risk Score: 25 (Low Risk)
Status: Active, Firewalled
EXECUTIVE SUMMARY
Intellect 85.208.96.204 is a low-risk IP address associated with Semrush's bot infrastructure. The address resolves to hostname 204.bl.bot.semrush.com and operates within the 85.208.96.0/24 CIDR block owned by Albert Valiev. The IP shows no active threat indicators, no blacklist listings, and no known malicious campaigns.
OWNERSHIP & NETWORK CLASSIFICATION
The IP is registered under ASN 209366 (Albert Valiev) with network name "crawlers." The subnet 85.208.96.0/24 is classified as mostly clean with an abuse density of 0.0769. The network contains 19 total sibling IPs, all showing low risk scores (25) with authority scores of 60. Control plane data indicates the BGP prefix 85.208.96.0/24 originated from ASN 209366 with route changes of 0 over the past 30 days.
GEOLLOCATION & INFRASTRUCTURE
Geolocation data places the IP in Ashburn, VA, US, though the 2500km accuracy radius indicates low confidence. The IP is not classified as cloud, CDN, VPN, proxy, Tor, hosting, mobile, residential, or anycast. DNS records show the IP resolves to semrush.com with PTR hostname 204.bl.bot.semrush.com. Email authentication includes SPF and DMARC records.
THREAT INDICATORS
The IP shows zero blacklist entries, no known attacker status, no spam source designation, and no Tor exit node classification. Threat indicators are empty across all feeds. DNSBL listings count 1 out of 8 total lists. The operator score of 0.3478 labeled as "Basic." No honeypot hits or enumeration strikes were recorded.
SERVICE FINGERPRINT
The IP shows "Firewalled / No Services" status with no open ports, TLS certificates, HTTP titles, server banners, or certificates detected. DNSSEC is valid with CAA records present. HTTP2, HSTS, CSP, and referrer policy headers were not observed.
OBSERVATION HISTORY
Eighteen total observations were recorded, with the most recent on 2026-07-22. Historical data shows consistent operator scores around 0.3478 and subnet abuse density of 0.0769. No ownership changes were detected. Threat observation count is zero, and the IP is not flagged as persistently malicious.
NETWORK RELATIONSHIPS
DNS relationships show multiple associations with hostname 204.bl.bot.semrush.com. Network relationships indicate affiliation with the "crawlers" network block. No certificate or organization relationships beyond the DNS hostname were identified.
RECOMMENDATIONS
No specific firewall rules or security actions were generated due to the low-risk profile. The IP appears to be legitimate infrastructure for search engine bot operations. No blocking is recommended absent additional contextual threat signals.
ASSESSMENT
85.208.96.204 is a low-risk IP associated with Semrush's crawler infrastructure. The address exhibits characteristics of legitimate bot operations rather than malicious activity. SOC teams may observe traffic from this IP during normal web crawling operations. No immediate action required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Albert Valiev |
| ASN | AS209366 |
| Network Name | crawlers |
| CIDR Block | 85.208.96.0/24 |
| RIR | RIPE |
| Country | US |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 204.bl.bot.semrush.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 204.bl.bot.semrush.com |
🔐 DNS Hygiene
| Hygiene Score | 100% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS209366 |
| Network Prefix | 85.208.96.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 19% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 19% | 2 | 2 |
| Overall | 17% | 9 | 11 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-02 00:59:35 UTC |
| Last Seen | 2026-08-22 17:15:00 UTC |
| Profile Built | 2026-08-29 17:15:44 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 21 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 85.208.96.204
Who owns the IP address 85.208.96.204?
85.208.96.204 is registered to Albert Valiev. The address falls within the 85.208.96.0/24 network block. Registration is held at RIPE.
Where is 85.208.96.204 located?
Geolocation data places 85.208.96.204 in Ashburn, Virginia, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 85.208.96.204 malicious or safe?
85.208.96.204 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.
What is the hostname for 85.208.96.204?
The reverse DNS (PTR) record for 85.208.96.204 is 204.bl.bot.semrush.com. This hostname is forward-confirmed, meaning it resolves back to the same address.