91.228.33.5📋 Copy

IP Intelligence Briefing: 91.228.33.5

Date: 2026-06-11

---

**1. Core Profile**

• Risk Score: 80 (High Risk)
• Ownership: Registered to MNT-INSITE-SPZOO (Poland) under ASN 56838.
• Geolocation: Rozprza, Łódź Voivodeship, Poland (51.31°N, 19.64°E).
• Network Role: Firewalled / No Services (no open ports or TLS services detected).
• Threat Indicators: No direct malware, phishing, or campaign activity detected.

---

**2. Observation History**

• Recent Activity (2026-06-11):

- Traceroute confirmed 13 hops, with RTT ranging from 123–134 ms.

- Geolocation validated as plausible (901.7 km from probe, 18.03 ms minimum possible RTT).

- DNSSEC valid, but 5 DNSBL listings (e.g., Spamhaus, OpenBL).

• Historical Trends:

- No persistent malicious activity; threat observation count is 0.

- Stability score indicates minimal routing changes over 30 days.

---

**3. Network Relationships**

• Subnet: 91.228.32.0/22 (shared with 60 IPs).
• Key Relationships:

- Linked to Vatus network (same ASN/organization).

- No direct connections to known malicious entities or campaigns.

---

**4. Neighborhood Analysis**

• Subnet Abuse Density: 25% (moderate risk).
• High-Risk Neighbors:

- 15 IPs with risk scores ≥80 (e.g., 91.228.33.7, 91.228.33.17).

• Low-Risk Neighbors: 14 IPs with risk scores ≤50.
• Notable: 10 IPs with zero risk scores (possibly dormant or clean).

---

**5. Actionable Insights**

• Monitor Neighbors: The subnet contains high-risk IPs; investigate potential lateral movement or shared infrastructure.
• Check DNSBL Status: Confirm if DNSBL listings are tied to spam or abuse (e.g., Spamhaus, OpenBL).
• Geolocation Verification: Validate if the IP’s location aligns with the organization’s claimed region.
• Network Segmentation: Ensure firewalled services are isolated from public-facing assets.

---

Conclusion:

91.228.33.5 is a high-risk IP registered to a Polish entity, with no direct malicious indicators but linked to a subnet containing mixed-risk neighbors. While not a primary threat, its DNSBL associations and high-risk neighbors warrant closer monitoring. SOC teams should prioritize validating geolocation and investigating potential abuse patterns in the subnet.

Tools Used: `ipdebrief_profile`, `ipdebrief_history`, `ipdebrief_relationships`, `ipdebrief_neighbors`.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.