95.91.249.105📋 Copy

# IP Intelligence Briefing: 95.91.249.105/32

## Executive Summary

IP address 95.91.249.105 presents as a low-risk residential endpoint with moderate reputation scores. The address is associated with Kabel Deutschland (Vodafone) infrastructure and shows no active threat indicators. Historical observation data indicates minor DNSBL listings but no persistent malicious behavior.

---

## Profile Analysis

Risk Assessment

• Risk Score: 30 (Low Risk)
• Reputation: Low Risk
• Provider Score: 0
• Authority Score: 0

Ownership & Infrastructure

• ASN: 3209 (Kabel Deutschland RIPE)
• Organization: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19
• CIDR Block: 95.90.0.0/15
• RIR: RIPE
• Provider Type: Mobile carrier infrastructure (Vodafone GmbH, DE)

Network Role

• Classification: Mobile broadband endpoint
• Services: None detected (Firewalled/No Services)
• Open Ports: None
• TLS/HTTP: No active services

---

## Geolocation & Resolution

Location Data

• Primary Location: New York, US (geoConsensus: false)
• Secondary Location: Berlin, Germany (historical observation)
• Geo Plausibility: Inconsistent data (geoPlausible: false)
• Forward Resolution: ip5f5bf969.dynamic.kabel-deutschland.de

DNS Configuration

• PTR Record: ip5f5bf969.dynamic.kabel-deutschland.de
• DNSSEC: Valid
• Email Authentication: SPF/DMARC not configured

---

## Threat Indicators

Current Threat Status

• Abuse Confidence Score: Not reported
• Blacklist Count: 2 of 8 total DNSBL listings
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None

Control Plane

• Route Stability: False (route changes detected)
• Route Changes (30d): 0
• DNSBL Listed: Yes (2 of 8 lists)
• RPKI State: Not reported

---

## Observation History

Historical Signals (15 total observations)

• Latest Observation: 2026-07-26
• DNSBL Listings: 2 entries with medium severity
• DNSSEC Status: Valid
• Geo Consensus: Inconsistent (US/DE discrepancies)
• Threat Persistence: Not persistently malicious

Trend Analysis

• No significant escalation in threat signals
• Historical data shows standard residential broadband patterns
• Minor blacklist presence does not indicate active threat

---

## Relationships

Network Associations

• Subnet: 95.91.249.105/24
• Network Name: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19
• DNS Association: ip5f5bf969.dynamic.kabel-deutschland.de

---

## Neighborhood Analysis

Subnet Risk Profile (95.91.249.0/24)

• Total Neighbors: 6
• Abuse Density: 0
• Risk Distribution: 2 high, 2 medium, 2 low

Neighbor Risk Scores

Assessment: Neighborhood shows mixed risk profile with 33% high-risk neighbors. Target IP sits at moderate risk level (30).

---

## Recommended Actions

Security Recommendations

• No immediate blocking required
• Monitor for service activity emergence
• Consider geo-verification due to inconsistent location data
• Review DNSBL listings for context

Firewall Rules

• No specific iptables/nftables rules recommended
• Standard residential broadband monitoring applies

---

## Conclusion

IP 95.91.249.105 represents a standard residential broadband endpoint from Kabel Deutschland infrastructure. The address shows no active threat indicators and maintains a low-risk profile. Minor DNSBL presence does not indicate malicious activity. SOC teams may monitor for service activity but no immediate defensive actions are warranted.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.