89.231.35.49📋 Copy

# IP Intelligence Briefing: 89.231.35.49/32

## Executive Summary

IP address 89.231.35.49 is a Polish residential endpoint (ASN 21021, Arknet) with a moderate risk score of 55. No active threat indicators detected. The /24 subnet demonstrates mixed classification with 2 threat-sibling IPs and an abuse density of 0.286, warranting defensive monitoring.

## Profile Overview

## Threat Assessment

• Threat Indicators: None detected
• Blacklist Status: 0 blacklists, but 3 DNSBL listings out of 8 total
• Tor/Proxy: Not a Tor exit node, not a known proxy
• Known Attacker: No
• Spam Source: No
• Active Services: No open ports detected (firewalled)

## Neighborhood Analysis (89.231.35.0/24)

The /24 subnet shows elevated abuse density with 8 total sibling IPs:

• High Risk Siblings: 2 (scores: 80, 80)
• Medium Risk Siblings: 5 (scores: 55)
• Low Risk Siblings: 0
• Abuse Density: 0.286 (28.6%)
• Active Siblings: 3
• Threat Siblings: 2

High-risk neighbors include:

• 89.231.35.27 (Risk: 80)
• 89.231.35.37 (Risk: 80)

## Observation History

24 observations recorded since 2026-06-05. Key findings:

• Subnet abuse density measured at 0.25 (mixed classification) on 2026-06-05
• Control plane routing signals show stable operator score of 0.1304
• No persistent malicious behavior detected
• Threat observation count: 1
• Ownership stability: 0 changes

## Network Relationships

51 relationships identified, primarily Same Network associations with Arknet infrastructure. No certificate matches or correlated campaign indicators.

## Recommended Actions

Given the moderate risk classification and neighborhood context:

1. Monitor traffic from this IP and adjacent high-risk siblings (89.231.35.27, 89.231.35.37)

2. Block if outbound connection attempts detected to internal assets

3. Correlate with any existing alerts from subnet neighbors

4. Review firewall rules for Arknet prefix 89.231.0.0/16 if policy requires

## Conclusion

IP 89.231.35.49 represents a residential endpoint with no direct threat indicators. However, the subnet environment demonstrates 28.6% abuse density, suggesting this IP may be co-located with malicious actors. SOC analysts should monitor for lateral movement patterns and consider blocking inbound connections from the broader /16 prefix if organizational policy mandates.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.