91.228.123.224📋 Copy

## IP Intelligence Briefing: 91.228.123.224/32

Executive Summary

Target IP 91.228.123.224 is classified as High Risk with a risk score of 70. The address belongs to LANPRO-NET (ASN 197218), an organization registered to PP Dmutrashko Evgeny Vitalievich in Ukraine. The IP operates as a web server with HTTPS service but presents multiple threat indicators including DNSBL listings and unstable routing.

Ownership & Geolocation

• Organization: PP Dmutrashko Evgeny Vitalievich
• ASN: 197218
• Network Block: 91.228.122.0/23
• Geolocation: Ukraine (UA), Europe/Kyiv timezone
• Registration: RIR Ripe
• Contact: Abuse contact available via RDAP

Threat Assessment

• Risk Score: 70/100 (High Risk)
• DNSBL Listings: Listed on 4 out of 8 total blacklist feeds
• Threat Classification: Known attacker indicators present (confidence: 0.75)
• Abuse Confidence: Not explicitly flagged as spam source or Tor exit, but threat indicators confirmed
• Service: HTTPS (port 443/tcp) open

Network Context

• Subnet Analysis: 91.228.123.0/24 contains 25 sibling IPs
• Active Siblings: 13 currently active
• Threat Siblings: 3 high-risk neighbors
• Subnet Abuse Density: 8.3% (2 high-risk, 16 medium-risk, 6 low-risk neighbors)
• Neighboring High-Risk IPs: 91.228.123.173 (70), 91.228.123.199 (70), 91.228.123.215 (80), 91.228.123.244 (80)

Technical Observations

• DNS Resolution: Forward resolution failed, no PTR record
• Traceroute: 15 hops, 3 timed out, transit through Comcast
• Route Stability: Unstable routing (isRouteStable: false)
• Historical Activity: 18 observations recorded, most recent from July 31, 2026
• Campaign Correlation: No active campaign matches detected

Network Behavior

• Connection Type: Web server (not cloud, CDN, proxy, or VPN)
• Mobile Carrier: None
• Honeypot Hits: 0
• Email Authentication: No SPF/DMARC records detected

Recommended Actions

1. Block or Monitor: Implement firewall rules to block or monitor inbound/outbound traffic to/from this IP due to high-risk classification

2. DNSBL Review: Investigate specific blacklist listings (4/8 feeds) to understand abuse patterns

3. Neighborhood Monitoring: Monitor the 91.228.123.0/24 subnet, particularly high-risk neighbors (91.228.123.215, 91.228.123.244, 91.228.123.199, 91.228.123.173)

4. Threat Correlation: Track for any activity matching the 3 threat siblings in the subnet

5. Route Stability: Monitor routing changes as the BGP prefix shows instability

Conclusion

This IP presents a moderate-to-high threat profile suitable for defensive blocking or enhanced monitoring. The combination of DNSBL listings, unstable routing, and presence in a moderately abused subnet warrants SOC attention. No active campaign correlation detected, but the abuse density of the /24 subnet suggests coordinated malicious activity may be occurring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.