91.228.123.252📋 Copy

# INTELLIGENCE BRIEFING: 91.228.123.252/32

## Executive Summary

Target IP 91.228.123.252 is classified as Low Risk with a risk score of 30. The IP operates within the LANPRO-NET network (ASN 197218), registered to PP Dmutrashko Evgeny Vitalievich under RIPE routing policies. Current threat indicators show no active malicious activity, but neighborhood analysis indicates elevated abuse density (15%) within the /24 subnet.

## Ownership and Infrastructure

• ASN: 197218 (LANPRO-NET)
• Organization: PP Dmutrashko Evgeny Vitalievich
• CIDR Block: 91.228.122.0/23
• RIR: RIPE
• Abuse Contact: Available via RDAP

## Network Classification

The IP presents as firewalled with no active services exposed. Key attributes:

• Service Status: Firewalled / No Services
• Open Ports: None detected
• Cloud/CDN/Proxy: Not identified
• Mobile Carrier: None

## Geolocation Assessment

• Country: Latvia (LV)
• Geo Consensus: Inconsistent (2 sources, no consensus)
• Geo Plausibility: Valid
• Note: Historical signals indicate conflicting geolocation data including Ukraine references

## Threat Intelligence Profile

• Risk Score: 30 (Low Risk)
• Blacklist Status: 0 blacklists
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Threat Persistence: None observed
• Campaign Correlation: No matches

## Control Plane Analysis

• BGP Prefix: 91.228.122.0/23
• Route Stability: Unstable (false)
• DNSSEC Validation: Valid
• DNSBL Listings: 2 of 8 total lists
• Operator Score: 0.1304 (Minimal)

## Neighborhood Assessment (91.228.123.0/24)

• Subnet Classification: Mostly Clean
• Abuse Density: 15%
• Total Siblings: 20
• Active Siblings: 8
• Threat Siblings: 3

Risk Distribution in Subnet:

• High Risk: 0
• Medium Risk: 13 IPs
• Low Risk: 6 IPs

Notable neighbors with risk scores of 55 (medium-high): 91.228.123.29, 91.228.123.57, 91.228.123.83, 91.228.123.102, 91.228.123.103, 91.228.123.164, 91.228.123.174, 91.228.123.192, 91.228.123.204, 91.228.123.236

## Historical Observations

16 total observations recorded. Recent signals (2026-07-25) show:

• Geolocation signals with Ukraine coordinates (48.38, 31.17) at 52% confidence
• Ownership and ASN data consistently resolved
• No persistent threat indicators over observation period

## DNS and Email Analysis

• Forward Resolution: None
• Hosted Domains: 0
• Email Auth: No SPF/DMARC records
• PTR Hostnames: None

## Recommended Actions

No firewall or blocking rules recommended at this time. The IP presents a low-risk profile with no active threat indicators. SOC analysts should monitor for changes in neighborhood abuse density and any new threat indicators emerging from the LANPRO-NET infrastructure.

## SOC Analyst Notes

While the target IP shows low individual risk, the /24 subnet contains 13 medium-risk IPs and 3 threat IPs. Consider:

1. Monitoring for lateral movement indicators within the 91.228.123.0/24 subnet

2. Reviewing firewall logs for connections to high-risk neighbor IPs

3. Watching for changes in the target's service exposure or geolocation signals

---

*Intelligence generated from IPDebrief platform. All data sourced from live network observations and threat feeds.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.