91.238.166.52
IP Intelligence Briefing: 91.238.166.52
Date: 2026-06-06
---
**1. Core Profile**
- Risk Assessment: Low risk (30/100), no known malicious indicators.
- Ownership: Owned by SCARNET Sp. z o.o. (PL), ASN 60195.
- Geolocation: Poland (PL), JastrzΔdz, Mazovia (51.92°N, 19.15°E).
- Network Role: Firewalled / no services detected (open ports: none).
- DNS: PTR hostname `host-91-238-166-52.scarnet.eu` linked to `scarnet.eu`.
- Threat Indicators: No malware, spam, or attacker associations.
---
**2. Observation History**
- Recent Activity (2026-06-06):
- Minimal risk score (0.13), stable network.
- DNSsec and CAA records validated.
- 2 DNSBL listings (out of 8 total).
- No Tor, CDN, or mobile carrier associations.
---
**3. Relationships**
- DNS Associations:
- Repeated PTR hostname `host-91-238-166-52.scarnet.eu`.
- Network Links:
- Same ASN (60195) and network (`PL-SCARNET`).
- No correlated IPs or campaigns.
---
**4. Neighborhood Analysis**
- Subnet: 91.238.166.0/24.
- Abuse Density: 83.3% (high risk in subnet).
- High-Risk Neighbors:
- 5 IPs with risk scores β₯80 (e.g., 91.238.166.110, 91.238.166.159).
- 1 medium-risk neighbor (91.238.166.165).
- Note: Subnet contains potential threats; monitor for lateral movement.
---
**5. Actionable Insights**
- SOC Recommendations:
- Monitor the 91.238.166.0/24 subnet for unusual traffic.
- Validate DNS records (`scarnet.eu`) for spoofing risks.
- Investigate high-risk neighbors (e.g., 91.238.166.110) for potential compromise.
- Firewall: No immediate blocking required for this IP, but consider rules for the subnet.
Conclusion: This IP appears benign, but its subnet contains high-risk neighbors. Prioritize monitoring the broader network for potential threats.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
π’ Ownership & Registration
| Organization | SCARNET Sp. z o.o. |
| ASN | AS60195 |
| Network Name | β |
| CIDR Block | β |
| RIR | RIPE |
| Country | β |
| Abuse Contact | Available via RDAP |
π DNS Intelligence
| PTR | host-91-238-166-52.scarnet.eu |
| Forward Confirmed | No β PTR hostname does not resolve back to this IP (weak signal) |
| Forward Hostnames | host-91-238-166-52.scarnet.eu |
π DNS Hygiene
| Hygiene Score | 40% (Fair) |
| SPF | Present |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
βοΈ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown β Insufficient routing data to classify |
π Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Server | β |
| HTTP Title | β |
π TLS Certificate
| SANs | None |
| Valid From | β |
| Valid Until | β |
π― Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 8% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 22% | 1 | 3 |
| geolocation | 19% | 2 | 2 |
| Overall | 19% | 9 | 13 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
π Observation Timeline π Live
| First Seen | 2026-05-11 02:52:07 UTC |
| Last Seen | 2026-06-26 07:33:24 UTC |
| Profile Built | 2026-06-26 07:38:13 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 19 |
Full dossier details are available via our API.