91.224.92.35📋 Copy

# IP Intelligence Briefing: 91.224.92.35/32

Classification: Moderate Risk

Date: Current Intelligence Cycle

---

## Executive Summary

IP address 91.224.92.35 presents a moderate risk profile (Risk Score: 40) with associated blacklist listings and originates from a high-abuse density subnet. The IP is associated with infrastructure under SERVEROFFER_LT and operates within the 91.224.92.0/24 subnet, which demonstrates 75% abuse density. No active services were detected on this endpoint.

---

## Technical Profile

Ownership & Registration

• ASN: 209605 (BSTLT-MNT)
• RIR: RIPE NCC
• Origin BGP Prefix: 91.224.92.0/24
• AS Path: 6939 → 209605
• Route Stability: Stable (no changes in 30 days)
• RPKI State: Valid

Geolocation

• Country: United Kingdom (GB)
• Timezone: Europe/London
• Geo Accuracy: 500 km radius

DNS & Hostname Resolution

• PTR Record: srv-91-224-92-35.serveroffer.net
• Forward Resolution: srv-91-224-92-35.serveroffer.net
• Domain: serveroffer.net
• Email Authentication: SPF configured, DMARC absent

---

## Threat Indicators

• Reputation Sources: Multiple blacklist listings (8 total)
• DNSBL Status: Listed on 2 of 8 threat feeds
• Blacklist Severity: Medium
• Campaign Associations: None identified
• Known Attacker Status: Negative
• Tor Exit Node: No
• Spam Source: Negative

Network Classification Flags

• Infrastructure Type: Firewalled / No Services
• Cloud Provider: No
• CDN: No
• VPN/Proxy: No
• Hosting Provider: No
• Mobile/Residential: No

---

## Neighborhood Analysis (91.224.92.0/24)

• Subnet Classification: High Abuse
• Abuse Density: 0.75 (75%)
• Total Siblings Analyzed: 13
• Inherited Risk Score: 15

Notable Neighboring IPs

Assessment: The subnet exhibits elevated malicious activity with 8 medium-risk and 5 low-risk neighbors. Multiple IPs in the /24 block have been flagged with Risk Score 65 or higher.

---

## Observation History

• Total Observations: 22
• Recent Activity: Blacklist listings observed (medium severity)
• Network Prefix Stability: Stable (no BGP announcements in 30-day window)
• Ownership Changes: None recorded
• Threat Persistence: No persistent malicious behavior detected
• Campaign Correlation: None

---

## Recommended Defensive Actions

Firewall Rules

• iptables: `iptables -A INPUT -s 91.224.92.35 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 91.224.92.35 drop`
• nginx: `deny 91.224.92.35;`

WAF Integration

• Cloudflare WAF: Block IP with filter expression `ip.src eq 91.224.92.35`
• AWS WAF: Add address `91.224.92.35/32` to web ACL

---

## SOC Analyst Notes

1. Risk Context: IP carries moderate risk (40) but operates within a high-abuse subnet (75% abuse density). Consider blocking at perimeter level.

2. Subnet Correlation: Multiple neighbors in 91.224.92.0/24 have elevated risk scores (65+). Recommend subnet-level analysis if threat persistence is observed.

3. Infrastructure: No services detected on this endpoint. May be dormant or behind strict firewalls.

4. Historical Trend: No significant escalation in threat observations. Risk profile remains stable.

---

Status: Actionable Intelligence — Block at network perimeter. Monitor for service activation or campaign association updates.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.