95.32.199.185📋 Copy

IP Intelligence Briefing: 95.32.199.185/32

Classification: Moderate Risk Residential Endpoint

---

Executive Summary

IP address 95.32.199.185 was identified as a residential endpoint operated by Rostelecom PJSC (ASN 12389) in Voronezh, Russia. The IP carries a risk score of 40 and is classified as moderate risk. No active threat indicators were observed, though the IP was listed on 2 of 8 queried DNSBLs with an overall operator score of 0.1304 (minimal).

---

Ownership & Infrastructure

• Organization: ROSTELECOM-MNT (ROSTELECOM PJSC)
• Network Name: MACROREGIONAL_CENTER
• CIDR Block: 95.32.128.0/17
• RIR: RIPE
• Geolocation: Voronezh, Russia (RU, VOR)
• Infrastructure Type: Residential
• Mobile Carrier: Tele2 RU (MCC: 250, MNC: 20)
• Connection Type: LTE

The IP is confirmed as a residential mobile endpoint with no cloud, CDN, proxy, or hosting characteristics.

---

Network Signals & Services

No active services were detected. Port scanning revealed no open ports. DNS resolution was unsuccessful with no PTR hostnames or forward resolutions. No TLS certificates or HTTP services were observed.

---

Threat Indicators

• Blacklist Status: Listed on 2 of 8 DNSBLs
• Threat Feeds: No active indicators in Pulsedive or known campaigns
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Abuse Confidence Score: Not available

The IP is not flagged as a known attacker, Tor exit node, or spam source.

---

Control Plane & Routing

• Origin ASN: 12389
• BGP Prefix: 95.32.192.0/20
• Route Stability: Unstable
• RPKI State: Not validated
• IRR Consistency: Not available
• Route Changes (30d): 0
• MoAS Status: False

---

Neighborhood Analysis

The /24 subnet (95.32.199.0/24) contains only the target IP with no sibling neighbors. Abuse density is 0.0, and no threat siblings were identified in the neighborhood.

---

Temporal Observations

Fourteen signal observations were recorded between 2026-07-31. Recent signals confirmed:

• Subnet classification: Clean
• Inherited risk: 0
• Abuse density: 0
• One active sibling with zero threats
• No ownership changes detected
• No persistent malicious behavior

The IP shows stable residential characteristics with no escalation in threat activity.

---

Relationship Graph

The relationship graph contains only network-level associations to MACROREGIONAL_CENTER. No hostnames, organizations, or certificates were linked to this IP.

---

Recommended Actions

No specific firewall or mitigation rules were generated. The IP presents moderate risk due to residential mobile classification and minimal DNSBL listings, but lacks active threat indicators.

Summary Assessment: This IP represents a legitimate residential mobile endpoint in Voronezh, Russia with moderate risk characteristics primarily driven by mobile carrier classification and minor DNSBL presence. No immediate threat activity was observed, and the neighborhood shows no correlated abuse.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.