92.195.37.199📋 Copy

IP INTELLIGENCE BRIEFING: 92.195.37.199

Classification: Moderate Risk | Date: 2026-07-29

---

SUMMARY

IP address 92.195.37.199 was analyzed and classified as Moderate Risk (risk score: 40/100). The address is assigned to Plusnet Internet Services (ASN 20676) under the PLUSNET-WHOLESALE-1 network block (92.195.0.0/16), registered with Ripe RIR. Geolocation data places the IP in Eisenach, Thuringia, Germany. No active services or open ports were detected.

OWNERSHIP & INFRASTRUCTURE

• ASN: 20676 (Plusnet Internet Services)
• Network: PLUSNET-WHOLESALE-1 / 92.195.0.0/16
• RIR: Ripe
• Geolocation: Germany (DE), Eisenach, Thuringia (51.17°N, 10.45°E)
• DNS: port-92-195-37-199.dynamic.as20676.net
• Network Role: Firewalled/No Services

THREAT INDICATORS

The IP showed no malicious activity indicators. Specific findings include:

• No known attacker reputation
• Not identified as spam source
• Not a Tor exit node
• Zero blacklist count
• No associated threat campaigns
• No email reputation data available

NETWORK BEHAVIOR

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Connection Type: Firewall protected
• Control Plane: 2 DNSBL listings out of 8 total lists; BGP prefix 92.195.0.0/16; Route stability flagged as false

NEIGHBORHOOD ANALYSIS

Subnet 92.195.37.199/24 was classified as clean with an abuse density of 0. No sibling IPs showed active or threat indicators. The neighborhood demonstrated zero high-risk, medium-risk, or low-risk neighboring addresses.

OBSERVATION HISTORY

Nineteen signal observations were recorded, most recently on 2026-07-29. Key observations include:

• ICMP validation attempts with blocked ICMP responses
• Traceroute probes showing 30-hop paths to target
• DNS resolution confirmed to dynamic hostname
• No persistent malicious activity detected
• Geo-location consistently resolved to Germany with 400km accuracy radius

RELATED ENTITIES

Six relationships were identified:

• DNS associations to port-92-195-37-199.dynamic.as20676.net (3 occurrences)
• Network associations to PLUSNET-WHOLESALE-1 (3 occurrences)

No external organization, certificate, or hostname links beyond DNS and network associations.

RECOMMENDED ACTIONS

Based on risk profile, the following firewall rules were generated:

ASSESSMENT

The IP address presents moderate risk primarily due to DNSBL listings and lack of service verification. However, no active threat indicators were observed. The address is part of a residential/ISP infrastructure (Plusnet) with clean neighborhood reputation. SOC analysts may consider blocking at perimeter controls, though correlation with additional threat intelligence sources is recommended before enforcement.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.