# 95.91.252.65 — IP Intelligence Summary

95.91.252.65 is an IPv4 address operated by Kabel Deutschland RIPE (AS3209), geolocated to Munich, Germany. It belongs to a mobile network with reverse DNS name ip5f5bfc41.dynamic.kabel-deutschland.de. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/95.91.252.65
- Last updated: 2026-10-06

## Ownership

- Organization: Kabel Deutschland RIPE
- Network name: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19
- Allocated block: 95.90.0.0/15
- ASN: AS3209 (https://ipdebrief.com/asn/3209)
- Regional registry: RIPE

## Location

- City: Munich
- Region: Bavaria
- Country: Germany
- Time zone: Europe/Berlin

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: yes
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ip5f5bfc41.dynamic.kabel-deutschland.de
- Forward-confirmed: yes

## Analyst narrative

\# INTELLIGENCE BRIEFING: 95.91.252.65/32

**Classification:** LOW RISK

**Date:** Current

**Analyst:** IPDebrief Intelligence

\---

\## EXECUTIVE SUMMARY

IP address 95.91.252.65 is classified as low-risk with a risk score of 15/100. The address is associated with residential mobile infrastructure in Munich, Germany. No active threat indicators or malicious behavior observed. No automated security actions recommended at this time.

\---

\## PROFILE DATA

**Ownership & Infrastructure:**

\- ASN: 3209 (Kabel Deutschland RIPE)

\- Organization: KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19

\- CIDR Block: 95.90.0.0/15

\- RIR: RIPE

\- Abuse Contact: Available via RDAP

**Geolocation:**

\- Country: Germany (DE)

\- Region: Bavaria

\- City: Munich

\- Coordinates: 51.17°N, 10.45°E

\- Timezone: Europe/Berlin

\- Geo Confidence: Consensus validated

**Network Classification:**

\- Mobile Device: TRUE (Vodafone LTE/5G, MCC: 262, MNC: 02)

\- Residential: FALSE

\- ISP/Hosting/Cloud/Proxy: FALSE

\- Tor Exit Node: FALSE

\- Services: Firewalled / No Services Detected

\- Open Ports: None

**DNS Resolution:**

\- PTR Hostname: ip5f5bfc41.dynamic.kabel-deutschland.de

\- Domain: kabel-deutschland.de

\- Forward Resolution Confirmed: TRUE

\- Email Authentication (SPF/DMARC): Not configured

\---

\## THREAT ASSESSMENT

**Current Risk Indicators:**

\- Risk Score: 15 (Low)

\- Abuse Confidence Score: Not available

\- Blacklist Count: 0

\- DNSBL Listed: 1 of 8 lists

\- Known Campaigns: None

\- Threat Feeds: Clean

**Control Plane:**

\- BGP Origin ASN: 3209

\- BGP Prefix: 95.88.0.0/14

\- Route Stability: Not stable

\- RPKI State: Not evaluated

\- DNSSEC Valid: TRUE

\---

\## OBSERVATION HISTORY

Total observations recorded: 18

**Recent Signal Summary (2026-07-24):**

\- Subnet Classification: CLEAN

\- Abuse Density: 0

\- Inherited Risk: 0

\- Ownership Changes: 0

\- Threat Persistence Days: 0

\- Persistently Malicious: FALSE

Historical trend indicates stable, benign activity with no escalation in risk posture over the observation period.

\---

\## RELATIONSHIP ANALYSIS

Total relationships identified: 7

**Relationship Types:**

\- DNS Associations: 5 entries pointing to ip5f5bfc41.dynamic.kabel-deutschland.de

\- Network Associations: 2 entries within KABEL-DEUTSCHLAND-CUSTOMER-SERVICES-19

**Campaign Correlation:**

\- Cert Matches: 0

\- Banner Matches: 0

\- Correlated IPs: 0

No evidence of association with threat actors or coordinated campaigns.

\---

\## NEIGHBORHOOD ANALYSIS (95.91.252.0/24)

**Subnet Overview:**

\- Total Neighbor IPs: 5

\- Abuse Density: 0

\- Subnet Classification: Not evaluated

**Neighbor Risk Distribution:**

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 95.91.252.72 | 40 | 60 |

| 95.91.252.146 | 40 | 60 |

| 95.91.252.197 | 40 | 60 |

| 95.91.252.199 | 55 | 60 |

| 95.91.252.253 | 15 | 60 |

Risk distribution: 0 high, 4 medium, 1 low risk. The target IP shares the same /24 subnet with 4 medium-risk neighbors and 1 low-risk neighbor.

\---

\## RECOMMENDED ACTIONS

No automated security actions or firewall rules generated. The IP presents low threat characteristics consistent with residential mobile infrastructure.

**SOC Analyst Guidance:**

\- Monitor as part of normal baseline traffic

\- No immediate blocking or filtering required

\- Consider contextual correlation if unexpected traffic patterns emerge

\- No escalation to threat hunting warranted at this time

\---

**END OF BRIEFING**

## Nearby addresses

- 95.91.252.72 (https://ipdebrief.com/95.91.252.72)
- 95.91.252.146 (https://ipdebrief.com/95.91.252.146)
- 95.91.252.197 (https://ipdebrief.com/95.91.252.197)
- 95.91.252.199 (https://ipdebrief.com/95.91.252.199)
- 95.91.252.253 (https://ipdebrief.com/95.91.252.253)

---

Source: IPDebrief, "95.91.252.65 IP intelligence", https://ipdebrief.com/95.91.252.65, updated 2026-10-06. Assessments are probabilistic.