141.98.11.82📋 Copy

# IP Intelligence Briefing: 141.98.11.82/32

## Executive Summary

IP 141.98.11.82 presents a moderate risk profile (Risk Score: 55) associated with hostbaltic infrastructure in Vilnius, Lithuania. While no active threat indicators are currently observed, the IP is listed on three DNSBLs and resides within a subnet showing mixed abuse characteristics.

## Ownership & Network Classification

• ASN: 209605 (AS209605 uab host baltic)
• Organization: mnt-lt-hostbaltic-1
• RIR: RIPE
• Location: Vilnius, Lithuania (56°N, 24°E)
• Network Block: 141.98.11.0/24
• Route Stability: Unstable (route changes detected in 30-day window)
• Service Purpose: Firewalled / No Services

## DNS & Email Configuration

• PTR Hostname: airplane.medyamol.com
• Domain: medyamol.com
• Email Authentication: SPF and DMARC records configured

- SPF: `v=spf1 include:spf.protection.outlook.com ip4:69.65.15.24 -all`

- DMARC: `v=DMARC1; p=reject; rua=mailto:dmarc@medyamol.com`

• DNSSEC: Valid
• DNSBL Status: Listed on 3 of 8 threat intelligence lists

## Threat Indicators & Reputation

• Reputation: Moderate Risk
• Threat Indicators: None active
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Likelihood: None
• Known Campaigns: None
• Blacklist Count: 0 (direct blacklist matches)

## Neighborhood Analysis (141.98.11.0/24)

The /24 subnet demonstrates mixed-risk characteristics:

• Abuse Density: 0.2308 (moderate)
• Classification: Mixed
• Total Siblings: 13
• Active Siblings: 2
• Threat Siblings: 3
• Risk Distribution: High (0), Medium (10), Low (3)

Notable neighbors include 141.98.11.11, 141.98.11.48, 141.98.11.117, 141.98.11.120, 141.98.11.171, and 141.98.11.182 (Risk Score: 55).

## Relationship Graph

• Network Associations: LT-HOSTBALTIC-11 (multiple entries)
• DNS Associations: airplane.medyamol.com (multiple entries)

## Observation History

Historical observations indicate:

• June 25, 2026: DNS records for medyamol.com with SPF/DMARC validation
• June 5, 2026: Subnet classified as mixed with abuse density 0.2308; IP detected on AlienVault OTX threat feeds (50 pulse matches)

## Recommended Actions

Based on current risk profile:

1. Monitor DNSBL listings: Three DNSBL listings suggest historical abuse patterns

2. Track route stability: Unstable routing may indicate infrastructure changes

3. Subnet context: Monitor neighboring IPs (141.98.11.x) for coordinated activity

4. Email reputation: Verify SPF/DMARC alignment for medyamol.com domain

5. No immediate block: Moderate risk without active threat indicators; maintain logging and monitoring

## Risk Assessment

This IP warrants continued monitoring rather than immediate blocking. The DNSBL listings and subnet abuse density suggest historical compromise or policy violations. The lack of active threat indicators and proper email authentication configuration supports a moderate rather than high-risk classification. Recommend correlation with other detection signals before taking escalation actions.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.