# 95.91.249.105 — IP Intelligence Summary

95.91.249.105 is an IPv4 address operated by Kabel Deutschland RIPE (AS3209), geolocated to Munich, Germany. It belongs to a mobile network with reverse DNS name ip5f5bf969.dynamic.kabel-deutschland.de. As of August 31, 2026, IPDebrief rates it Low Risk (30/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/95.91.249.105
- Last updated: 2026-08-31

## Ownership

- Organization: Kabel Deutschland RIPE
- Network name: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19
- Allocated block: 95.90.0.0/15
- ASN: AS3209 (https://ipdebrief.com/asn/3209)
- Regional registry: RIPE

## Location

- City: Munich
- Region: Bavaria
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (30/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ip5f5bf969.dynamic.kabel-deutschland.de
- Forward-confirmed: yes

## Analyst narrative

\# IP Intelligence Briefing: 95.91.249.105/32

\## Executive Summary

IP address 95.91.249.105 presents as a low-risk residential endpoint with moderate reputation scores. The address is associated with Kabel Deutschland (Vodafone) infrastructure and shows no active threat indicators. Historical observation data indicates minor DNSBL listings but no persistent malicious behavior.

\---

\## Profile Analysis

**Risk Assessment**

\- **Risk Score:** 30 (Low Risk)

\- **Reputation:** Low Risk

\- **Provider Score:** 0

\- **Authority Score:** 0

**Ownership & Infrastructure**

\- **ASN:** 3209 (Kabel Deutschland RIPE)

\- **Organization:** KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19

\- **CIDR Block:** 95.90.0.0/15

\- **RIR:** RIPE

\- **Provider Type:** Mobile carrier infrastructure (Vodafone GmbH, DE)

**Network Role**

\- **Classification:** Mobile broadband endpoint

\- **Services:** None detected (Firewalled/No Services)

\- **Open Ports:** None

\- **TLS/HTTP:** No active services

\---

\## Geolocation & Resolution

**Location Data**

\- **Primary Location:** New York, US (geoConsensus: false)

\- **Secondary Location:** Berlin, Germany (historical observation)

\- **Geo Plausibility:** Inconsistent data (geoPlausible: false)

\- **Forward Resolution:** ip5f5bf969.dynamic.kabel-deutschland.de

**DNS Configuration**

\- **PTR Record:** ip5f5bf969.dynamic.kabel-deutschland.de

\- **DNSSEC:** Valid

\- **Email Authentication:** SPF/DMARC not configured

\---

\## Threat Indicators

**Current Threat Status**

\- **Abuse Confidence Score:** Not reported

\- **Blacklist Count:** 2 of 8 total DNSBL listings

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Tor Exit Node:** No

\- **Known Campaigns:** None

**Control Plane**

\- **Route Stability:** False (route changes detected)

\- **Route Changes (30d):** 0

\- **DNSBL Listed:** Yes (2 of 8 lists)

\- **RPKI State:** Not reported

\---

\## Observation History

**Historical Signals (15 total observations)**

\- **Latest Observation:** 2026-07-26

\- **DNSBL Listings:** 2 entries with medium severity

\- **DNSSEC Status:** Valid

\- **Geo Consensus:** Inconsistent (US/DE discrepancies)

\- **Threat Persistence:** Not persistently malicious

**Trend Analysis**

\- No significant escalation in threat signals

\- Historical data shows standard residential broadband patterns

\- Minor blacklist presence does not indicate active threat

\---

\## Relationships

**Network Associations**

\- **Subnet:** 95.91.249.105/24

\- **Network Name:** KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19

\- **DNS Association:** ip5f5bf969.dynamic.kabel-deutschland.de

\---

\## Neighborhood Analysis

**Subnet Risk Profile (95.91.249.0/24)**

\- **Total Neighbors:** 6

\- **Abuse Density:** 0

\- **Risk Distribution:** 2 high, 2 medium, 2 low

**Neighbor Risk Scores**

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 95.91.249.47 | 55 | 60 |

| 95.91.249.75 | 30 | 60 |

| 95.91.249.107 | 0 | 50 |

| 95.91.249.150 | 25 | 60 |

| 95.91.249.161 | 0 | 50 |

| 95.91.249.223 | 55 | 60 |

**Assessment:** Neighborhood shows mixed risk profile with 33% high-risk neighbors. Target IP sits at moderate risk level (30).

\---

\## Recommended Actions

**Security Recommendations**

\- No immediate blocking required

\- Monitor for service activity emergence

\- Consider geo-verification due to inconsistent location data

\- Review DNSBL listings for context

**Firewall Rules**

\- No specific iptables/nftables rules recommended

\- Standard residential broadband monitoring applies

\---

\## Conclusion

IP 95.91.249.105 represents a standard residential broadband endpoint from Kabel Deutschland infrastructure. The address shows no active threat indicators and maintains a low-risk profile. Minor DNSBL presence does not indicate malicious activity. SOC teams may monitor for service activity but no immediate defensive actions are warranted.

## Nearby addresses

- 95.91.249.47 (https://ipdebrief.com/95.91.249.47)
- 95.91.249.75 (https://ipdebrief.com/95.91.249.75)
- 95.91.249.107 (https://ipdebrief.com/95.91.249.107)
- 95.91.249.150 (https://ipdebrief.com/95.91.249.150)
- 95.91.249.161 (https://ipdebrief.com/95.91.249.161)
- 95.91.249.223 (https://ipdebrief.com/95.91.249.223)

---

Source: IPDebrief, "95.91.249.105 IP intelligence", https://ipdebrief.com/95.91.249.105, updated 2026-08-31. Assessments are probabilistic.