93.152.221.138📋 Copy

# IP Intelligence Briefing: 93.152.221.138/32

Date: Current

Classification: Moderate Risk

Risk Score: 50/100

---

## Executive Summary

Target IP 93.152.221.138 presents a moderate risk profile (score: 50) with an open RDP port and multiple DNSBL listings. While the subnet 93.152.221.0/24 is classified as "clean" with zero abuse density, the target IP warrants monitoring due to its individual threat indicators.

---

## Network Attribution

---

## Threat Indicators

• Risk Score: 50/100 (Moderate)
• DNSBL Listings: 2 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Campaign Correlation: None detected

---

## Service Exposure

• Port 3389/TCP: Open (RDP)
• PTR Records: None
• Forward DNS Resolution: Not confirmed
• HTTP/HTTPS Services: None detected

---

## Subnet Analysis

Subnet: 93.152.221.0/24

• Classification: Clean
• Abuse Density: 0
• Total Siblings: 15
• Active Siblings: 9
• Threat Siblings: 0
• Risk Distribution: 6 medium-risk, 8 low-risk neighbors

Notable Neighbors:

• 93.152.221.91 (Risk: 50)
• 93.152.221.118 (Risk: 50)
• 93.152.221.206 (Risk: 50)

---

## Historical Observations

Total observations: 17

Recent Activity (2026-07-31):

• Geolocation signals indicating Boston, US-MA (confidence: 0.85)
• Traceroute analysis: 30 hops, target not reached
• ASN signals: AS3320 (Deutsche Telekom AG) referenced
• Subnet classification remained consistent: "clean"

Temporal Stability:

• Ownership changes: 0
• Threat persistence days: 0
• Not persistently malicious

---

## Network Relationships

Four relationship entities identified, all categorized as "Same Network" (IPv4). No certificate, hostname, or organization relationships detected.

---

## Recommended Actions

Immediate Mitigation:

Operational Notes:

• Block recommendation based on risk score 50 and open RDP port
• Monitor subnet 93.152.221.0/24 for correlation of activity from medium-risk neighbors
• Verify geolocation discrepancy (BG country vs US-MA region data)

---

## Assessment

The target IP exhibits moderate risk characteristics primarily driven by open RDP access and DNSBL presence. The subnet-level cleanliness suggests isolated risk rather than coordinated abuse. Recommended approach: block at perimeter, maintain monitoring, and investigate any connection attempts for potential credential-based attacks.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.