89.251.0.187📋 Copy

## IP Intelligence Briefing: 89.251.0.187

Classification: LOW RISK / MINIMAL THREAT PROFILE

---

Executive Summary

IP address 89.251.0.187 is associated with AS41564 (VPN Consumer Toronto, Canada) and presents a low-risk profile (risk score: 25). The IP is currently firewalled with no open services, no active DNS resolution, and no known threat indicators. While historical data indicates some geolocation inconsistencies and transient blacklist activity, current operational state shows minimal threat exposure.

---

Network Attribution

• ASN: AS41564
• Organization: VPN Consumer Toronto, Canada
• BGP Prefix: 89.251.0.0/24
• Geolocation: Toronto, Ontario, Canada (consensus: true)
• Route Stability: False (route changes detected in past 30 days)

Threat Indicators

• Risk Score: 25 (Low Risk)
• Known Campaigns: None
• Blacklist Status: Currently unlisted
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Feeds: No active indicators

Operational State

• Infrastructure Type: Unknown (not classified as cloud, CDN, VPN, proxy, or hosting)
• Services: Firewalled / No services detected
• Open Ports: None
• DNS Resolution: No forward resolution, no PTR records
• Email Reputation: No email services detected

Neighborhood Analysis (89.251.0.0/24)

• Subnet Size: 43 active sibling IPs
• Abuse Density: 13.95% (0.1395)
• Risk Distribution: 46 low-risk, 1 medium-risk, 0 high-risk
• Threat Siblings: 6 identified threat IPs within subnet
• Classification: Mostly clean subnet

Historical Observations

Analysis of 18 historical observations reveals:

• Most Recent (2026-06-24): Minimal risk score (0), operator score (0)
• Geolocation Consistency: Mixed signals—Toronto, CA (current) vs. Auckland, NZ (historical)
• Blacklisting Activity: One observation on 2026-06-03 showed listing across 8 blacklists (categories omitted), but current status is clean
• Signal Confidence: Varied between 0.19–0.85 across observations
• Threat Persistence: Single threat observation; not persistently malicious

Relationship Graph

13 relationship entries all link to network identifier TORONTO-CA-89-251-0-0, indicating consistent network attribution.

---

Recommended Actions

• Firewall Rule: No immediate blocking recommended
• Monitoring: Continue passive observation
• Investigation Priority: LOW
• Context: IP is part of a mostly clean subnet with low abuse density; current firewalled state suggests no active malicious service

---

Conclusion

IP 89.251.0.187 is a low-risk address with no current threat indicators. The subnet shows moderate abuse density (13.95%), but the target IP is not among the identified threat siblings. Historical transient blacklist activity appears resolved. Recommend standard monitoring without additional investigative action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.