91.228.33.153📋 Copy

# IP INTELLIGENCE BRIEFING: 91.228.33.153/32

Date: 2026-06-26 | Classification: High Risk | Status: Active Monitoring Required

---

## EXECUTIVE SUMMARY

IP 91.228.33.153 presents as a high-risk address (risk score: 80/100) originating from Poland's Łódź Voivodeship. The IP is currently firewalled with no active services, yet remains listed across 8 DNS blacklists with 4 active listings at high severity. Subnet context indicates elevated threat density requiring defensive posture adjustments.

---

## NETWORK OWNERSHIP & GEOLOCATION

---

## THREAT INDICATORS & REPUTATION

• Risk Score: 80/100 (High Risk)
• DNSBL Listings: 8 total lists, 4 active listings
• Operator Score: 0.1304 (Minimal)
• Threat Classifications: No active threat campaigns detected
• Blacklist Severity: Maximum severity rating: High

---

## NETWORK BEHAVIOR & SERVICES

• Service Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• DNS Records: No PTR hostnames, no forward resolution
• Email Reputation: No SPF/DMARC records configured

---

## SUBNET ANALYSIS (91.228.33.0/24)

Notable High-Risk Neighbors:

• 91.228.33.5 (Risk: 80)
• 91.228.33.7 (Risk: 80)
• 91.228.33.17 (Risk: 80)
• 91.228.33.20 (Risk: 70)

---

## OBSERVATION HISTORY

Recent signal activity (June 26, 2026):

• Blacklist Activity: Listed on 8 total lists with 3 high-severity entries
• Operator Assessment: Minimal (score: 0)
• Subnet Abuse Density: 0.2097 at time of observation
• Geographic Validation: Confirmed plausible (901.7km distance, 5 probes)

---

## RELATIONSHIP ANALYSIS

• 16 relationship entries detected
• Primary associations: Network-level connections to Vatus infrastructure
• No certificate or hostname relationships identified
• No correlated campaign indicators

---

## RECOMMENDED ACTIONS

1. Block at perimeter firewall — High-risk score with active blacklist presence

2. Monitor subnet 91.228.33.0/24 — Elevated abuse density (0.18) with 11 high-risk siblings

3. Review DNSBL entries — 4 active listings across 8 lists require investigation

4. Consider blocklist propagation — High-severity listings indicate malicious activity

---

Analyst Notes: While the IP shows no active services or open ports, the combination of high-risk score, active DNSBL listings, and subnet context suggests continued monitoring and defensive blocking is warranted. The subnet's mixed classification with 11 high-risk neighbors indicates broader infrastructure-level risk.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.