91.230.225.52📋 Copy

IP Intelligence Briefing: 91.230.225.52/32

Executive Summary

Target IP 91.230.225.52 operates as a VPN service endpoint under ExpressVPN (ASN 206092) within the NL-NETROUTING-20210920 network block. Current risk assessment indicates low-risk status with a risk score of 25. No active malicious threat indicators were detected during profile analysis.

Ownership and Network Classification

• Organization: ExpressVPN
• ASN: 206092 (security firewall ltd)
• Network Block: 91.230.225.0/24
• RIR: RIPE
• Classification: VPN Service

Geolocation

• Country: NL (Netherlands)
• Region: England
• City: London
• Coordinates: 52.13°N, 5.29°E
• Timezone: Europe/Amsterdam
• Accuracy Radius: 150km

Threat Profile

• Overall Risk Score: 25
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• DNSBL Listed Count: 1 (of 8 total lists)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Threat Persistence Days: 0
• Persistently Malicious: No

Network Services

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Service Purpose: Firewalled / No Services
• Fingerprint: Standard firewall signature

Historical Observations

Analysis of 17 signal observations revealed consistent VPN infrastructure behavior. Recent subnet-level metrics indicate:

• Subnet Abuse Density: 0.1429
• Classification: Mostly Clean
• Total Subnet Siblings: 84
• Active Siblings: 53
• Threat Siblings: 12
• Ownership Changes: 0

Network role signals show the IP maintains consistent provider classification with no observed malicious activity patterns.

Neighborhood Analysis

Subnet 91.230.225.0/24 contains 83 neighboring IPs with the following risk distribution:

• High Risk: 0
• Medium Risk: 1
• Low Risk: 79

Multiple sibling IPs (91.230.225.26, 91.230.225.27, 91.230.225.29, 91.230.225.30) share risk score 25 with authority score 50, indicating consistent VPN infrastructure deployment across the subnet.

Network Relationships

Relationship graph identifies the IP as part of the NL-NETROUTING-20210920 network block. No external organizational or hostname relationships detected beyond network-level associations.

Recommended Actions

No specific blocking or mitigation actions recommended. IP maintains low-risk profile consistent with legitimate VPN service operations. Standard VPN traffic policies apply.

Assessment

The target IP represents legitimate VPN infrastructure with no evidence of malicious activity. Subnet-level analysis confirms predominantly clean operation. SOC teams may monitor but no immediate blocking required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.