91.221.134.73📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

Target: 91.221.134.73/32

Classification: LOW RISK – MONITOR

Date: 2026-07-25

Analysis: Automated threat intelligence assessment

---

## EXECUTIVE SUMMARY

IP 91.221.134.73 is a low-risk residential/ISP endpoint associated with Netpro (AS51927) infrastructure in Vienna, Austria. The IP demonstrates minimal threat indicators with no active services, no known malicious campaigns, and no persistent attacker classification. However, geolocation inconsistencies and limited DNS blacklist presence warrant continued monitoring.

---

## RISK PROFILE

---

## OWNERSHIP & INFRASTRUCTURE

• Organization: AS6700-MNT (NETPRO)
• ASN: 51927
• Network: 91.221.134.0/23
• RIR: RIPE
• Registration: Dynamic/residential endpoint
• Abuse Contact: office@netpro.rs

---

## GEOLOCATION ANALYSIS

Primary Location: Vienna, Austria (AT)

Confidence: Geo-inconsistent sources detected

• Profile sources indicate Austria
• Historical signals from Alienvault OTX and MaxMind indicate Serbia (RS)
• Status: Geographic disagreement requires validation

---

## THREAT INDICATORS

• Blacklist Status: 0 active blacklists (profile); 2 DNSBL listings (control plane)
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None detected
• Threat Feeds: Empty

---

## NETWORK BEHAVIOR

• Open Ports: None detected
• Services: Firewalled / No Services
• DNS: dynamic-91-221-134-73.netpro.rs (dynamic PTR)
• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 91.221.134.0/23
• DNSSEC: Valid

---

## NEIGHBORHOOD ANALYSIS (91.221.134.0/24)

Subnet Summary:

• Total Siblings: 4
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0 (Clean)
• Neighborhood Classification: Clean

---

## OBSERVATION HISTORY (17 Signals)

Recent signals (2026-07-25) indicate:

• ASN AS51927 netpro isp d.o.o (Serbia)
• Multiple geolocation sources reporting Serbia (RS)
• Consistent ownership data with no changes
• No persistent malicious activity detected
• Threat observation count: 0

---

## RELATIONSHIP MAPPING

• Network Relationships: 3 associations to NETPRO
• DNS Relationships: 3 associations to dynamic-91-221-134-73.netpro.rs
• No certificate or organizational links detected

---

## OPERATIONAL RECOMMENDATIONS

1. Allow Traffic: Low-risk endpoint with no active services; no immediate blocking required

2. Monitor: Track geolocation consistency across sources

3. Subnet Awareness: Monitor neighboring IPs 91.221.134.62 and 91.221.134.65 (medium risk)

4. DNSBL Review: Investigate 2 DNS blacklist listings for context

5. Route Stability: Monitor BGP stability due to route churn

---

## RISK INDICATORS SUMMARY

Positive:

• Low overall risk score (30)
• No active services or open ports
• No known malicious activity
• Clean neighborhood classification

Concerns:

• Geographic data inconsistency (AT vs RS)
• Route instability
• Limited DNS blacklist presence (2/8 lists)
• Elevated risk neighbors in same /24

Conclusion: This IP represents a benign residential/ISP endpoint with standard ISP characteristics. No immediate threat action required. Maintain monitoring for changes in risk posture or geographic consistency.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.