91.202.233.115📋 Copy

# IP INTELLIGENCE BRIEFING: 91.202.233.115/32

Classification: Moderate Risk | Report Date: Current

Status: Defensible – No Active Threat Indicators

---

## EXECUTIVE SUMMARY

IP 91.202.233.115 presents a moderate risk profile (score: 50) with no active threat indicators, blacklists, or known attack campaigns. The address is assigned to Russian infrastructure (ND7667-RIPE / RU-PROSPERO) with no evidence of malicious activity. Subnet-level abuse density is minimal, supporting a low-threat classification. Recommended for defensive blocking due to moderate risk score, but not required for immediate incident response.

---

## TECHNICAL PROFILE

Ownership & Registry

• ASN: 200593
• Organization: ND7667-RIPE
• Netname: RU-PROSPERO
• CIDR Block: 91.202.233.0/24
• RIR: RIPE
• Abuse Contact: Available via RDAP

Geolocation

• Country: RU (Russia)
• Region/City: Ashgabat (inference-based; accuracy radius: 5,000km)
• Note: Geolocation confidence limited (0.52); Ashgabat location appears inconsistent with Russian ISP routing.

Network Role

• Infrastructure Type: Unknown
• Service Classification: Firewalled / No Services
• Not Identified As: CDN, Cloud, Proxy, Tor Exit, VPN, Hosting, or Mobile

---

## THREAT ASSESSMENT

Risk Indicators

• Risk Score: 50 (Moderate)
• Blacklist Count: 0
• DNSBL Listed: 2 of 8 total lists
• Abuse Confidence Score: Not available
• Tor Exit / Known Attacker / Spam Source: None

Active Threat Indicators

• Campaign Likelihood: None
• Certificate Matches: 0
• Correlated IPs: 0
• Known Campaigns: None

Service Exposure

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• DNS Records: No forward resolution, no PTR hostnames

---

## OBSERVATION HISTORY

Total Observations: 18 signals recorded

Recent Activity (2026-07-22)

• Geolocation Signal: Russia inference (confidence 0.52)
• Network Classification: Provider infrastructure confirmed
• Service Scan: Ports scanned but no services detected
• Ownership Stability: No ownership changes; threat persistence: 0 days

Temporal Analysis

• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: False
• Threat Observation Count: 0

---

## RELATIONSHIP ANALYSIS

Connected Entities

• Same Network (RU-PROSPERO): 4 relationship entries
• Related Organizations: None beyond network-level affiliation
• Associated Hostnames: None
• Certificates: None

Control Plane

• Route Stability: False
• Route Changes (30d): 0
• RPKI State: Not available
• IRR Consistency: Not available
• DNSSEC Valid: True

---

## NEIGHBORHOOD ANALYSIS

Subnet: 91.202.233.0/24

• Abuse Density: 0 (Clean)
• Classification: Clean
• Inherited Risk: 0

Neighbor IP Analysis:

• 91.202.233.61: Risk Score 0 (Low)
• Total Siblings: 2
• Active Threat Siblings: 0

Assessment: The /24 subnet shows minimal abuse activity. Single neighbor IP carries no threat indicators.

---

## RECOMMENDED ACTIONS

Firewall Rules

Risk-Based Decision Matrix

Recommendation: Block (Risk Score 50 falls in recommended block range).

---

## CONCLUSION

IP 91.202.233.115 is a Russian-registered address with moderate risk scoring but no active malicious indicators. The subnet demonstrates clean neighborhood characteristics. While no immediate threat activity is observed, the risk score warrants defensive blocking in accordance with organizational policy. No additional investigation required absent correlated incidents.

---

Source: IPDebrief Intelligence Platform

Confidence: Medium (based on risk score 50 with no active threat indicators)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.