102.213.95.47📋 Copy

# IP Intelligence Briefing: 102.213.95.47

Date: 2026-07-22

Classification: Moderate Risk

Status: Active Monitoring Required

## Executive Summary

IP address 102.213.95.47 presents a moderate risk profile (Risk Score: 40/100) with geolocation indicators pointing to Nairobi, Kenya. The IP is classified as having no active services and is currently firewalled, though it appears in DNS blacklist listings (2 of 8 total). No active threat campaigns or known attacker associations were identified.

## Technical Profile

Geolocation

• Country: Kenya (KE)
• Region: Nairobi County
• City: Nairobi
• Coordinates: -1.28, 36.82
• Timezone: Africa/Nairobi
• Geolocation Confidence: High (Geo consensus confirmed)

Network Classification

• ASN: 329183
• BGP Prefix: 102.213.95.0/24
• IP Purpose: Firewalled / No Services
• Network Role: Infrastructure (No open ports detected)
• Service Detection: None

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 2
• DNSBL Total Lists: 8
• Active Attacker: No

## Observed Behavior

Historical Signals (7 Total Observations)

• Recent geolocation signals consistently identify Nairobi, Kenya
• DNSSEC validation confirmed for reverse zone (47.95.213.102.in-addr.arpa)
• Operator score: 0.1304 (Minimal)
• No persistent malicious behavior detected
• Threat persistence days: 0

Behavioral Analysis

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0
• Auto-Banned: No

## Network Neighborhood

Subnet: 102.213.95.0/24

• Abuse Density: 0%
• Total Siblings: 2 identified
• Risk Distribution: 0 High, 1 Medium, 1 Low

Identified Neighbors:

Note: Neighbor 102.213.95.50 demonstrates elevated risk (55) and warrants monitoring.

## Relationship Graph

No relationships detected. The IP does not appear to have associated hostnames, organizations, certificates, or linked subnet entities in the relationship network.

## Recommended Actions

Based on the risk profile, the following defensive measures are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 102.213.95.47 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 102.213.95.47 drop`
• nginx: `deny 102.213.95.47;`
• pfSense: `102.213.95.47/32`

WAF Recommendations

• Cloudflare WAF: Block IP with expression `ip.src eq 102.213.95.47`
• AWS WAF: Add 102.213.95.47/32 to block list

Additional Intelligence

• Monitor subnet 102.213.95.0/24 for elevated activity, particularly neighbor 102.213.95.50
• Verify if DNS blacklist listings correlate with observed behavior
• Review for any service provisioning that would change network classification

## Assessment

IP 102.213.95.47 exhibits moderate risk characteristics with DNS blacklist presence but lacks active threat indicators. The absence of open services and zero behavioral incidents suggests the IP may be dormant or misconfigured. However, the DNSBL listings warrant continued monitoring. The subnet abuse density of 0% indicates the immediate neighborhood is not heavily abused, though adjacent IP 102.213.95.50 shows elevated risk and should be added to watch lists.

Priority: Medium

Action Required: Firewall blocking recommended; continued monitoring advised.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.