# 92.208.31.252 — IP Intelligence Summary

92.208.31.252 is an IPv4 address operated by Vodafone Germany IP Core Backbone (AS3209), geolocated to Essen, Germany. It belongs to a mobile network with reverse DNS name ipservice-092-208-031-252.092.208.pools.vodafone-ip.de. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/92.208.31.252
- Last updated: 2026-10-06

## Ownership

- Organization: Vodafone Germany IP Core Backbone
- Network name: VFDE-IP-SERVICE-01
- Allocated block: 92.208.0.0/15
- ASN: AS3209 (https://ipdebrief.com/asn/3209)
- Regional registry: RIPE

## Location

- City: Essen
- Region: North Rhine-Westphalia
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: MobileCarrier
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ipservice-092-208-031-252.092.208.pools.vodafone-ip.de
- Forward-confirmed: yes

## Analyst narrative

\# INTELLIGENCE BRIEFING: IP 92.208.31.252/32

**Classification:** Low Risk - Mobile Infrastructure

**Date:** 2026-07-26

**Status:** Active Monitoring

\---

\## EXECUTIVE SUMMARY

IP address 92.208.31.252/32 is a Vodafone Germany mobile infrastructure endpoint classified as Low Risk. The address represents a residential mobile service endpoint (Vodafone LTE/5G) with no open services, no blacklist listings, and no active threat indicators. While the immediate IP shows no malicious activity, the /24 subnet contains moderate abuse density with two threat-sibling IPs identified.

\---

\## NETWORK ATTRIBUTES

| Attribute | Value |

|-----------|-------|

| **Organization** | Vodafone Germany IP Core Backbone |

| **ASN** | 3209 |

| **CIDR Block** | 92.208.0.0/15 |

| **Location** | Essen, North Rhine-Westphalia, DE |

| **Network Role** | Mobile Carrier Endpoint |

| **Connection Type** | LTE/5G (Mobile) |

\---

\## RISK ASSESSMENT

**Current Risk Score:** 0 (Low Risk)

**Threat Indicators:**

\- Blacklist Count: 0

\- Is Tor Exit Node: No

\- Is Known Attacker: No

\- Is Spam Source: No

\- Known Campaigns: None detected

**Service Status:** No open ports; endpoint appears firewalled with no active services.

\---

\## NEIGHBORHOOD ANALYSIS (92.208.31.0/24)

**Abuse Density:** 0.3333 (Low-Moderate)

**Subnet Classification:** Mixed

**Sibling IP Risk Distribution:**

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 92.208.31.20 | 25 | 60 |

| 92.208.31.24 | 0 | 60 |

| 92.208.31.29 | 25 | 60 |

| 92.208.31.94 | 0 | 60 |

| 92.208.31.209 | 0 | 50 |

**Note:** Two sibling IPs (92.208.31.20, 92.208.31.29) show elevated risk scores (25) requiring monitoring.

\---

\## OBSERVATION HISTORY

**Total Observations:** 21 signals collected

**Recent Activity (2026-07-26):**

\- ASN and organization confirmed as Vodafone Germany IP Core Backbone (confidence: 95%)

\- Geographic location validated to Germany (confidence: 52%)

\- Subnet abuse density observed at 0.3333 (confidence: 75%)

\- Inherited risk score: 5

**Temporal Analysis:** No persistent malicious activity detected. Ownership and threat persistence remain stable.

\---

\## DNS & HOSTNAME INTELLIGENCE

**Reverse DNS:** ipservice-092-208-031-252.092.208.pools.vodafone-ip.de

**Forward Resolution:** Confirmed

**Domain:** vodafone-ip.de

**Email Authentication:** SPF record present; DMARC not configured

\---

\## RECOMMENDED ACTIONS

**Firewall/Security Recommendations:**

\- No immediate blocking required; IP classified as legitimate mobile infrastructure

\- Monitor sibling IPs 92.208.31.20 and 92.208.31.29 for potential threat activity

\- Standard mobile traffic inspection recommended for inbound connections

**Threat Hunting Priority:** Low

\- No active campaigns or correlated IPs detected

\- No certificate or hostname associations beyond expected Vodafone infrastructure

\---

\## ANALYST NOTES

This endpoint represents normal mobile carrier infrastructure. The zero risk score and absence of threat indicators support classification as benign. However, the presence of two elevated-risk sibling IPs in the /24 subnet warrants continued monitoring. No defensive firewall rules or blocking actions are currently recommended.

## Nearby addresses

- 92.208.31.20 (https://ipdebrief.com/92.208.31.20)
- 92.208.31.24 (https://ipdebrief.com/92.208.31.24)
- 92.208.31.29 (https://ipdebrief.com/92.208.31.29)
- 92.208.31.73 (https://ipdebrief.com/92.208.31.73)
- 92.208.31.94 (https://ipdebrief.com/92.208.31.94)
- 92.208.31.107 (https://ipdebrief.com/92.208.31.107)
- 92.208.31.209 (https://ipdebrief.com/92.208.31.209)

---

Source: IPDebrief, "92.208.31.252 IP intelligence", https://ipdebrief.com/92.208.31.252, updated 2026-10-06. Assessments are probabilistic.