178.171.114.110📋 Copy

## IP Intelligence Briefing: 178.171.114.110/32

Classification: Low Risk | Risk Score: 25/100 | Status: Active

---

EXECUTIVE SUMMARY

IP 178.171.114.110 is associated with organization GOODLINE-INFO (ASN 213541) with geolocation data indicating Amsterdam, Netherlands. The address exhibits low-risk characteristics with no active threat indicators. The subnet demonstrates clean abuse density with six low-risk siblings and zero high-risk neighbors.

---

OWNERSHIP & GEOLOCATION

• Organization: Aleksej Korol'kov / GOODLINE-INFO
• ASN: 213541 (WS Telecom Inc)
• CIDR Block: 178.171.112.0/22
• Registered Country: NL (Netherlands)
• City: Amsterdam, North Holland
• RIR: RIPE

Notable Discrepancy: Historical routing data indicates ASN 213541 with Russian (RU) country code attribution. This geographic inconsistency warrants monitoring for potential route hijacking or multi-tenant infrastructure.

---

THREAT PROFILE

• Reputation: Low Risk
• Abuse Confidence Score: Not calculated
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• DNSBL Listings: 1 of 8 lists
• Blacklist Count: 0

The IP has not been flagged as a known campaign participant or persistent threat actor.

---

NETWORK BEHAVIOR

• Service Status: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No forward resolution; no PTR records
• SSL/TLS: No certificates detected
• Route Stability: Route marked as unstable (isRouteStable: false)
• BGP Prefix: 178.171.114.0/24
• Control Plane: Route changes detected within 30-day window

---

NEIGHBORHOOD ANALYSIS (178.171.114.0/24)

• Total Siblings: 7
• Active Siblings: 2
• Abuse Density: 0 (clean)
• Threat Siblings: 0
• Risk Distribution: 0 high / 0 medium / 6 low

Neighbor Risk Scores:

• 178.171.114.74: 0
• 178.171.114.77: 25
• 178.171.114.105: 25
• 178.171.114.149: 25
• 178.171.114.179: 15
• 178.171.114.237: 25

The subnet exhibits uniformly low-risk characteristics with no high-severity abuse indicators.

---

OBSERVATION HISTORY

• Total Observations: 13
• Latest Activity: 2026-07-29T22:22:35 UTC
• Threat Persistence Days: 0
• Persistence Status: Not persistently malicious

Historical data shows a single high-severity DNSBL listing detected. DNSSEC validation confirmed as valid.

---

RECOMMENDED ACTIONS

Current Risk Level: Low (Score 25)

Recommended Firewall Rules: No blocking required based on current risk profile.

Monitoring Triggers:

1. Geographic routing discrepancy (NL vs RU attribution)

2. Route instability flag

3. Single DNSBL listing

Action Priority: Monitor for changes in route stability or geographic attribution patterns.

---

INTELLIGENCE NOTES

This IP demonstrates characteristics of a legitimate, low-risk infrastructure address. The primary concern is the geographic discrepancy between NL registration and RU routing data, which may indicate multi-tenant hosting or potential route manipulation. The subnet's clean abuse density suggests this is not an abuse-heavy environment. No immediate blocking or defensive action recommended.

Confidence Level: High (based on 13 historical observations)

Data Freshness: Current (as of 2026-07-29)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.