91.234.139.33📋 Copy

## IP Intelligence Briefing: 91.234.139.33/32

Date: 2026-07-29

Analyst: IPDebrief Intelligence Team

Classification: Threat Intelligence Summary

---

EXECUTIVE SUMMARY

IP address 91.234.139.33 is classified as HIGH RISK with an overall risk score of 70/100. The IP is registered to Ukrainian entity PP Dmutrashko Evgeny Vitalievich under the LANPRO-NET network block (91.234.136.0/22). No active malicious services or open ports detected, though the IP maintains a persistent high-risk classification across observation cycles.

---

IP BASIC IDENTIFICATION

---

NETWORK ROLE & SERVICE PROFILE

Classification: Firewall / No Services Detected

• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Title: Not available
• DNS Records: No forward resolution, no PTR hostnames
• Email Authentication: No SPF/DMARC records
• Network Type: Not CDN, VPN, Proxy, Tor, or Cloud infrastructure

---

THREAT INDICATORS & REPUTATION

Threat Assessment: While the IP carries a high risk classification (70/100), no active threat indicators were detected. The IP is not identified as a Tor exit node, known attacker, or spam source. However, DNSBL listing on 4 of 8 threat feeds suggests historical or passive reputation issues.

---

GEOLOCATION VALIDATION

• Primary Location: Chernivtsi, Ukraine (Region 77)
• Geo Sources: 2 sources (consensus: true)
• Accuracy Radius: 500km
• Geo Plausible: False (some geographic discrepancy noted)
• Timezone: Europe/Kyiv

---

OBSERVATION HISTORY (14 Observations)

Recent Activity (2026-07-29):

• Ownership signals consistently show no changes
• ASN 197218 registered to PP Dmutrashko Evgeny Vitalievich
• Multiple geolocation sources confirm Ukraine/Chernivtsi
• Threat observation count: 1
• Is Persistently Malicious: False
• Threat Persistence Days: 0

Temporal Stability:

• Ownership changes: 0
• Route changes (30-day): 0
• Route stable: False
• Threat persistence: None observed

---

NEIGHBORHOOD ANALYSIS (91.234.139.0/24)

Subnet Profile:

• Total Siblings: 18 IPs
• Abuse Density: 0.056 (Moderate)
• Risk Distribution: 1 High, 11 Medium, 4 Low

High-Risk Neighbors:

Notable Pattern: The /24 subnet shows elevated risk concentration with 3 IPs scoring 70-80, suggesting potential coordinated activity or shared infrastructure abuse.

---

RELATIONSHIP GRAPH

• Same Network: LANPRO-NET (2 relationships identified)
• Related Entities: No additional relationships beyond network affiliation

---

CONTROL PLANE DATA

---

RECOMMENDED ACTIONS

For SOC/Security Teams:

1. Monitor Closely: Given the 70-risk score and neighborhood concentration of high-risk IPs (91.234.139.87, 91.234.139.220), implement enhanced logging and monitoring for traffic from this /24 block.

2. DNSBL Review: Investigate the 4 DNSBL listings to determine if this indicates historical abuse or false positives.

3. Network Context: The subnet shows elevated abuse density (0.056) with 11 medium-risk neighbors. Consider implementing egress filtering or rate limiting for the 91.234.136.0/22 block.

4. Geographic Considerations: Ukraine-based IPs may be subject to geopolitical intelligence monitoring. Validate traffic legitimacy based on business requirements.

5. Contact for Abuse: Abuse contact available via RDAP; email fastvd@gmail.com for abuse reporting if malicious activity is confirmed.

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.