193.29.139.231📋 Copy

# INTELLIGENCE BRIEFING: 193.29.139.231

Classification: MODERATE RISK

Date: 2026-07-25

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 193.29.139.231 is assigned to GREENHOST (ASN 47172) within the NL-GREENHOST network (193.29.139.0/24), Amsterdam, Netherlands. Current risk assessment: Moderate Risk (Score 40). The IP shows no active threat indicators but is listed on 2 of 8 DNS blacklists. Services are currently firewalled with no open ports detected.

---

## OWNERSHIP & GEOLOCATION

---

## THREAT ASSESSMENT

Threat Indicators: None detected

Known Campaigns: None detected

---

## NETWORK BEHAVIOR

• Services: Firewalled / No Services Detected
• Open Ports: None
• PTR Hostnames: None
• Forward Resolution: Not Confirmed
• SSL/TLS: Not Active
• HTTP: Not Active

---

## SUBNET ANALYSIS (193.29.139.0/24)

Risk Distribution Across /24:

• High Risk: 0 IPs
• Medium Risk: 15 IPs
• Low Risk: 11 IPs

Notable High-Risk Neighbors:

• 193.29.139.168 (Risk: 55)
• 193.29.139.203 (Risk: 55)
• 193.29.139.235 (Risk: 55)

---

## OBSERVATION HISTORY

• Total Observations: 13
• Recent Activity: 2026-07-25
• Ownership Changes: 0
• Threat Observation Count: 0
• Threat Persistence: 0 days
• Status: No persistent malicious activity detected

Recent signals confirm subnet classification as "clean" with no inherited risk from network peers.

---

## RELATIONSHIP ANALYSIS

• External Relationships: None detected
• Associated Networks: NL-GREENHOST (3 entries)
• Associated Domains: None
• Associated Certificates: None

---

## RECOMMENDED ACTIONS

Firewall/Blocking Rules

Assessment: While the IP shows moderate risk (40) and is listed on some DNSBLs, it currently presents no active threat indicators. Blocking is recommended based on risk score but should be validated against organizational policy and correlated with other threat intelligence sources.

---

## CONCLUSION

IP 193.29.139.231 is a legitimate hosting infrastructure address under GREENHOST's management in Amsterdam. The moderate risk score (40) stems primarily from DNSBL listings rather than active malicious behavior. No current threat indicators or known campaign associations detected. The subnet shows mixed risk levels but no threat siblings.

Recommendation: Monitor for service activation or threat indicator emergence. Consider blocking based on organizational policy given the DNSBL presence and risk score, but no immediate threat action required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.