102.216.240.71📋 Copy

# Threat Intelligence Briefing: 102.216.240.71

## Executive Summary

IP address 102.216.240.71 is classified as Low Risk (Risk Score: 25). The address belongs to ASN 328442 (Mohamad Ibrahim) and is geolocated to Kinshasa, Democratic Republic of Congo (CD). The IP operates with no open services (Firewalled / No Services) but shows historical DNSBL listings.

## Ownership & Registration

• Organization: Mohamad Ibrahim
• Network Block: 102.216.240.0/24 (102.216.240.0 - 102.216.240.255)
• ASN: 328442
• RIR: AFRINIC
• Registration Date: Allocated 2022-01-28

## Geolocation

• Country: Democratic Republic of Congo (CD)
• Region: Kinshasa City
• Coordinates: -4.33°, 15.31°

## Threat Profile

• Reputation: Low Risk
• Risk Score: 25
• Open Ports: None detected
• Service Status: Firewalled / No Services
• DNSBL Listings: 1 of 8 total lists (DNSBL Listed Count: 1)
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

## Network Context

• Control Plane: IRR Consistency: Match, RPKI State: Unknown
• Route Stability: False (isRouteStable: false)
• Network Classification: Most Clean
• Neighborhood: 3 threat siblings detected in /24 subnet
• Abuse Density: 0 (subnet-level)

## Historical Observations

Analysis of 17 observations reveals:

• Recent Activity: Observations recorded through June 2026
• Notable Event: On 2026-06-01, the IP was detected on 8 DNSBL lists with maximum severity rated as "high"
• Current Status: Threat observation count: 1; Not persistently malicious

## Related IPs (Same /24 Subnet)

Two neighboring IPs identified with the following risk profiles:

• 102.216.240.60: Risk Score 25 (Low)
• 102.216.240.61: Risk Score 65 (Medium)

## Recommended Actions

Based on the current low-risk classification and lack of open services:

• Monitor: Continue monitoring for service changes or new open ports
• Block: Not required at this time; IP is not a known attacker
• Alert Threshold: Consider alerting if DNSBL listings increase or services become active

## Conclusion

IP 102.216.240.71 presents a low threat profile. While historical DNSBL listings indicate past abuse activity, current network conditions show the host is firewalled with no active services. The subnet contains 2 additional IPs with varying risk scores, but the target IP itself does not exhibit active malicious indicators. No immediate blocking action is recommended; maintain monitoring posture.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.