91.210.169.154📋 Copy

# IP Intelligence Briefing: 91.210.169.154/32

Classification: Low Risk Infrastructure IP

Date: June 24, 2026

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 91.210.169.154 is a low-risk infrastructure endpoint associated with JSC "TIMEWEB" (ASN 9123) operating from St Petersburg, Russia. The IP shows minimal threat indicators but exhibits proxy/VPN characteristics and DNSBL listings. Recommended for monitoring but not immediate blocking.

---

## Technical Profile

Network Characteristics

• BGP Stability: Valid RPKI, stable routing (no route changes in 30 days)
• Control Plane: Delegation age 6,633 days, operator score 0.8261 (Professional)
• DNSBL Status: Listed on 1 of 8 DNSBLs (max severity: high)
• DNS Resolution: 925871-ca42523.tmweb.ru (tmweb.ru domain)
• Email Authentication: SPF and DMARC records present

---

## Threat Assessment

Current Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Open Services: None (firewalled/no services detected)
• Blacklist Count: 0 (profile-level), but DNSBL listed
• Abuse Confidence: Not elevated

Historical Signals (38 observations)

• June 24, 2026: Proxy check identified as VPN-type proxy (risk score: 66)
• June 4, 2026: DNSBL activity detected (8 total listings, 1 match at high severity)
• Geolocation Consistency: Russia/St Petersburg consistently reported across multiple sources

Neighborhood Analysis

• Subnet: 91.210.169.0/24
• Abuse Density: 1 (low-moderate)
• Classification: Mostly clean
• Threat Siblings: 1 identified in /24

---

## Relationships

• Network Affiliation: TW-Cloud (TIMEWEB Cloud infrastructure)
• Total Relationships: 500+ entities
• Infrastructure Type: Cloud hosting environment

---

## Recommended Actions

Firewall Rules

No immediate blocking recommended. Risk score (15) indicates low threat level.

Monitoring Recommendations

1. Proxy Behavior: Monitor for VPN/proxy activity patterns

2. DNSBL Watch: Track blacklist status changes

3. Traffic Patterns: Implement flow monitoring for cloud infrastructure baseline

4. Geolocation: Maintain Russia-based IP classification

Priority: LOW

Rationale: Infrastructure IP with no active threat indicators. Proxy classification suggests potential for abuse but does not constitute active malicious behavior.

---

## SOC Analyst Notes

This IP represents TIMEWEB cloud infrastructure in St Petersburg. While currently low-risk, the VPN/proxy classification warrants awareness for:

• Evasion attempts through cloud infrastructure
• Potential proxy abuse for command-and-control
• DNSBL fluctuations indicating past or intermittent abuse

Action: Add to watchlist for traffic pattern analysis. No immediate blocking required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.