91.230.225.53📋 Copy

# IP Intelligence Briefing: 91.230.225.53/32

Classification: LOW RISK

Date: 2026-07-29

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 91.230.225.53 is a low-risk address (Risk Score: 25) associated with ExpressVPN (AS206092), a commercial VPN provider. The address belongs to the 91.230.225.0/24 block, classified as "Firewalled / No Services" with no open ports or active services detected. No active threat campaigns or malicious indicators have been observed.

---

## Technical Profile

Ownership & Registration:

• ASN: 206092 (ExpressVPN)
• Network: NL-NETROUTING-20210920
• RIR: RIPE
• Abuse Contact: abuse-reports@vpnconsumer.com

Geolocation:

• Primary: Netherlands (NL)
• Secondary: London, England
• Coordinates: 52.13°N, 5.29°E
• Accuracy: 150km radius

Network Classification:

• Infrastructure Type: Firewall / No Services
• DNS: No forward resolution, no PTR records
• Email: No SPF/DMARC records detected
• Services: No open ports, no TLS certificates

Control Plane:

• BGP Prefix: 91.230.225.0/24
• Route Stability: False
• DNSBL Listed: 1 of 8 total lists

---

## Threat Intelligence Assessment

Current Threat Status: CLEAN

• Blacklist Count: 0
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Abuse Confidence Score: Null

Threat Indicators: None active

• No known campaigns correlated
• No threat feeds flagged
• No malware signatures observed

---

## Neighborhood Analysis (91.230.225.0/24)

Subnet Statistics:

• Total Siblings: 83 IPs
• Abuse Density: 0%
• Risk Distribution: 79 Low, 1 Medium, 0 High

Notable Neighbors (Risk Score 25):

• 91.230.225.26, .27, .29, .30
• All classified with authorityScore 50

Assessment: The subnet demonstrates low abuse density. The single medium-risk neighbor may warrant monitoring but does not indicate coordinated malicious activity.

---

## Observation History (15 Total Signals)

Recent Activity:

• 2026-07-29 23:02-23:03 UTC: Multiple observations recorded
• ASN confirmation: AS206092 security firewall ltd
• Ownership changes: 0 (stable)
• Threat persistence: 0 days (transient)
• Geo sources: Confirmed via Alienvault-OTX and Cymru

Signal Confidence:

• Organization: 95% (ExpressVPN)
• ASN: 85% confidence
• Geolocation: 75% confidence

---

## Recommended Actions

Classification: ROUTINE MONITORING

• Risk Score 25 indicates minimal threat
• No immediate blocking recommended
• No specific firewall rules generated
• Continue standard logging and monitoring

SOC Analyst Guidance:

• Traffic from this IP is expected VPN/legitimate service traffic
• No immediate threat response required
• Monitor for any behavioral changes or new threat indicators
• Subnet-wide abuse density remains negligible

---

## Conclusion

IP 91.230.225.53 represents a low-risk, commercial VPN infrastructure address. No malicious activity or threat indicators have been detected. The subnet exhibits normal operational behavior with minimal abuse density. Standard monitoring protocols are appropriate; no escalation or blocking actions are warranted at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.