91.92.215.12📋 Copy

# IP Intelligence Briefing: 91.92.215.12/32

Classification: Moderate Risk

Date of Analysis: 2026-07-22

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

Target IP 91.92.215.12 presents a moderate risk profile (score: 50) with inconsistent geolocation data. The IP is associated with RIPE RIR infrastructure, potentially linked to Data Planner (Tehran) based on ownership signals. Two DNSBL listings detected across 8 total threat intelligence feeds. No active services or campaigns observed. Route stability flags indicate potential infrastructure changes.

---

## Ownership and Geolocation

ASN/Infrastructure:

• Origin ASN: 58224
• BGP Prefix: 91.92.208.0/21
• RIR Registry: RIPE
• Route Status: Unstable (isRouteStable: false)
• RPKI State: Not verified

Geolocation Discrepancy:

• Profile Location: US (Boston, MA)
• Historical Signals: IR (Tehran, Iran)
• Multiple sources report conflicting origin data
• Geo validation shows inconsistent plausibility scores

Contact Information:

• Abuse Email: abuse-tehran@tci.ir

---

## Threat Indicators

DNSBL Status:

• Total Lists: 8
• Listed Count: 2
• Max Severity: High
• Status: Active listings require monitoring

Campaign Indicators:

• Known Campaigns: None identified
• Threat Feeds: No active matches
• Pulsedive Risk: Not assessed

Behavioral Analysis:

• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Active Attacker Status: No
• Honeypot Hits: 0
• WAF Violations: 0

---

## Network Services

Open Ports: None detected

TLS Certificate: Not present

HTTP Services: Not detected

DNS Records:

• PTR Hostnames: None
• Forward Resolution: Not confirmed
• Hosted Domains: 0

Control Plane:

• Origin ASN: 58224
• Route Changes (30d): 0
• DNSSEC Valid: Yes
• DNSBL Listed: 2 of 8 lists

---

## Neighborhood Analysis

Subnet: 91.92.215.12/24

• Total Siblings: 0
• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Inherited Risk: 0
• Classification: Clean

No neighboring IPs identified within the /24 subnet.

---

## Relationship Graph

Related Entities: None identified

• Associated Subnets: None
• Hostnames: None
• Organizations: None
• Certificates: None

---

## Observation History

Total Observations: 13

Recent Signals (2026-07-22):

• RIR: RIPE
• Organization: Data Planner (Tehran)
• Country: IR
• CIDR: 91.92.212.0/22
• Abuse Contact: abuse-tehran@tci.ir
• Geo Validation: Tehran coordinates (35.698N, 51.4115E)
• ICMP Validation: Blocked (unable to validate)
• Blacklist Status: 2 of 8 lists with high severity

---

## Recommended Actions

Firewall/Network Rules:

• Monitor for DNSBL listing changes
• Flag route stability anomalies
• Investigate geolocation discrepancies
• Apply moderate-risk filtering policies

Monitoring Priorities:

• Track DNSBL listing updates
• Monitor for service discovery
• Watch for relationship emergence
• Alert on route prefix changes

Severity Rating: Moderate

Action Required: Monitor and track

---

*Report generated from IPDebrief intelligence platform. Data sourced from multiple threat intelligence feeds and historical observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.