91.224.92.33📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target IP: 91.224.92.33/32

Date: 2026-07-24

Classification: Defensive Network Intelligence

---

## Executive Summary

IP address 91.224.92.33 presents as a low-risk infrastructure endpoint associated with the SERVEROFFER_LT network (ASN 209605). While the IP itself shows minimal threat indicators, the surrounding /24 subnet demonstrates elevated abuse density (11.8%), with multiple neighbors exhibiting high-risk profiles.

---

## Ownership and Infrastructure Profile

Network Registration:

• ASN: 209605 (BSTLT-MNT)
• Organization: SERVEROFFER_LT
• RIR: RIPE
• CIDR Block: 91.224.92.0/24
• Geolocation: United Kingdom (GB)
• Timezone: Europe/London

DNS Configuration:

• PTR Hostname: srv-91-224-92-33.serveroffer.net
• Forward Resolution: srv-91-224-92-33.serveroffer.net
• DNSSEC: Valid
• Email Authentication: No SPF/DMARC records detected

---

## Risk Assessment

Current Risk Score: 15 (Low Risk)

• Provider Score: 0
• Authority Score: 0

Threat Indicators:

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Is Cloud/CDN/VPN/Proxy: No

Network Classification:

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None

---

## Control Plane and Route Stability

• BGP Origin ASN: 209605
• AS Path: 3303 209605
• Route Stability: Unstable (1 change in last 30 days)
• DNSBL Listed: 1 of 8 total lists
• RPKI State: Not evaluated
• Route Changes (30d): 1

---

## Observation History

Signal Count: 19 observations

• Recent Activity: Observations recorded on 2026-07-24
• ASN Status: Allocated (2752 days old, registered 2019-01-10)
• Ownership Changes: 0
• Threat Persistence: 0 days
• Persistent Malicious Activity: No

---

## Neighborhood Analysis

Subnet: 91.224.92.0/24

• Total Siblings: 17 (excluding target)
• Abuse Density: 0.118 (11.8%)
• Risk Distribution: 2 High, 11 Medium, 4 Low

High-Risk Neighbors (Risk Score ≥ 65):

---

## Relationships

Identified Associations:

1. Same Network: SERVEROFFER_LT (network-level association)

2. DNS Association: srv-91-224-92-33.serveroffer.net (reverse DNS)

---

## Recommended Actions

Current Status: No immediate security actions required.

Defensive Recommendations:

1. Monitor Subnet Abuse: The /24 subnet shows 11.8% abuse density. Consider implementing egress filtering for traffic to/from 91.224.92.0/24.

2. Route Stability Alert: The BGP route shows instability (1 change in 30 days). Monitor for potential route hijacking attempts.

3. DNSBL Monitoring: IP is listed on 1 of 8 DNSBLs. Investigate the listing source and consider blacklisting if confirmed malicious.

4. Neighbor Correlation: High-risk neighbors (91.224.92.159, 91.224.92.190, 91.224.92.78, 91.224.92.127) warrant correlation with any inbound/outbound traffic logs.

---

## Conclusion

IP 91.224.92.33 is a low-risk infrastructure endpoint with no active threat indicators. The primary concern is the elevated abuse density within the parent /24 subnet. SOC analysts should correlate traffic patterns with the four identified high-risk neighbors and monitor BGP route changes for potential network instability.

Threat Level: LOW

Priority: ROUTINE MONITORING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.