# 95.91.224.34 — IP Intelligence Summary

95.91.224.34 is an IPv4 address operated by Kabel Deutschland RIPE (AS3209), geolocated to Hamburg, Germany. It belongs to a mobile network with reverse DNS name ip5f5be022.dynamic.kabel-deutschland.de. As of August 31, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/95.91.224.34
- Last updated: 2026-08-31

## Ownership

- Organization: Kabel Deutschland RIPE
- Network name: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19
- Allocated block: 95.90.0.0/15
- ASN: AS3209 (https://ipdebrief.com/asn/3209)
- Regional registry: RIPE

## Location

- City: Hamburg
- Region: Free and Hanseatic City of Hamburg
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ip5f5be022.dynamic.kabel-deutschland.de
- Forward-confirmed: yes

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target IP:** 95.91.224.34/32

**Date:** Current Intelligence Cycle

**Classification:** Moderate Risk

\---

\## EXECUTIVE SUMMARY

IP 95.91.224.34 is a German mobile network address associated with Kabel Deutschland's residential customer services network. The IP presents moderate risk (40/100) primarily due to dynamic mobile assignment characteristics and limited service observability. No active threat indicators, malware campaigns, or attack patterns were detected.

\---

\## OWNERSHIP & NETWORK ATTRIBUTES

| Attribute | Value |

|-----------|-------|

| **ASN** | 3209 (Kabel Deutschland RIPE) |

| **Organization** | KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19 |

| **CIDR Block** | 95.90.0.0/15 |

| **RIR** | RIPE |

| **Geolocation** | Hamburg, Germany (51.17°N, 10.45°E) |

| **Mobile Carrier** | Vodafone GmbH (MCC 262, MNC 02) |

| **Connection Type** | LTE/5G Mobile |

\---

\## THREAT ASSESSMENT

**Risk Score:** 40 (Moderate Risk)

**Reputation:** Moderate Risk

**Abuse Confidence:** Not Applicable

**Threat Indicators:**

\- Known Attacker: **NO**

\- Tor Exit Node: **NO**

\- Spam Source: **NO**

\- Blacklist Count: 0

\- DNSBL Listed: 2 of 8 lists

**Network Classification:**

\- Provider/Infrastructure: **NO**

\- Cloud/CDN/VPN/Proxy: **NO**

\- Hosting Service: **NO**

\- Mobile Network: **YES**

\- Residential: **NO**

\---

\## SERVICE OBSERVATION

**Open Ports:** None detected

**HTTP/TLS Services:** None observed

**Service Purpose:** Firewalled / No Services

No active services or open ports were identified. The IP appears to be a residential mobile endpoint without exposed network services.

\---

\## DNS ANALYSIS

| Field | Value |

|-------|-------|

| **PTR Hostname** | ip5f5be022.dynamic.kabel-deutschland.de |

| **Forward Resolution** | ip5f5be022.dynamic.kabel-deutschland.de |

| **Domain** | kabel-deutschland.de |

| **Forward Confirmed** | Yes |

| **SPF Record** | Not Present |

| **DMARC Record** | Not Present |

DNS configuration indicates dynamic mobile address assignment with no email authentication records.

\---

\## OBSERVATION HISTORY

**Total Observations:** 20 signals recorded

**Time Range:** Recent 24-hour window

**Key Trends:**

\- Subnet classification remained **clean** with 0 abuse density

\- Ownership changes: 0 (stable assignment)

\- Threat observation count: 0

\- No persistent malicious behavior detected

\- Geolocation inference: Hamburg, Germany (confidence 0.52)

\- Network tracing: Target unreachable (ICMP blocked, 30 hops)

\---

\## NETWORK RELATIONSHIPS

**Connected Entities:**

\- **DNS Association:** ip5f5be022.dynamic.kabel-deutschland.de (10 instances)

\- **Same Network:** KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19

No certificate associations or cross-network relationships identified.

\---

\## NEIGHBORHOOD ANALYSIS

**Subnet:** 95.91.224.34/24

**Abuse Density:** 0

**Classification:** Clean

**Total Siblings:** 1

**Active Siblings:** 0

**Threat Siblings:** 0

**Risk Distribution:** High: 0, Medium: 0, Low: 0

The /24 subnet shows no abuse activity and contains no sibling threat indicators.

\---

\## CONTROL PLANE DATA

\- **Origin ASN:** 3209

\- **BGP Prefix:** 95.88.0.0/14

\- **Route Stable:** NO

\- **RPKI State:** Not Available

\- **IRR Consistency:** Not Available

\- **Route Changes (30d):** 0

\- **DNSSEC Valid:** YES

\- **Operator Score:** 0.2609 (Basic)

\---

\## SOC ACTIONABLE INTELLIGENCE

**Assessment:** This IP represents a standard mobile residential endpoint with no active threat indicators. The moderate risk classification reflects:

1. Mobile network assignment characteristics

2. Dynamic DNS hostname

3. Limited service observability

**Recommended Actions:**

\- **Monitor:** Continue observing for service changes or threat indicator emergence

\- **Block:** Not required at this time

\- **Allow:** Standard traffic permitted

\- **Investigate:** No immediate threat warrants proactive investigation

**Priority:** LOW

**False Positive Risk:** MEDIUM (dynamic mobile assignment may appear as suspicious in automated systems)

\---

**Report Generated:** IPDebrief Intelligence Platform

**Data Sources:** RDAP, DNS, BGP, Threat Feeds, Network Scanning

## Nearby addresses

- 95.91.224.36 (https://ipdebrief.com/95.91.224.36)
- 95.91.224.80 (https://ipdebrief.com/95.91.224.80)
- 95.91.224.200 (https://ipdebrief.com/95.91.224.200)

---

Source: IPDebrief, "95.91.224.34 IP intelligence", https://ipdebrief.com/95.91.224.34, updated 2026-08-31. Assessments are probabilistic.