# 194.44.140.200 — IP Intelligence Summary 194.44.140.200 is an IPv4 address operated by AS3255-MNT (AS3255), geolocated to Lviv, Ukraine. As of October 7, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/194.44.140.200 - Last updated: 2026-10-07 ## Ownership - Organization: AS3255-MNT - Network name: UARNET-RADIOSERVICE-WIFI-20050629 - Allocated block: 194.44.140.0/24 - ASN: AS3255 (https://ipdebrief.com/asn/3255) - Regional registry: RIPE ## Location - City: Lviv - Region: Lviv - Country: Ukraine - Time zone: Europe/Kyiv ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: High Risk (80/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 194.44.140.200/32 **Classification:** HIGH RISK **Date:** 2026-07-24 **Prepared For:** SOC Operations Team \--- \## Executive Summary IP address 194.44.140.200 presents a high-risk profile (Score: 70/100) associated with Ukrainian infrastructure. The IP belongs to a RIPE-allocated /24 subnet in Lviv with elevated neighborhood abuse density. Recommended action: Implement blocking at perimeter defenses and increase logging for traffic correlation. \--- \## Network Attribution | Attribute | Value | |-----------|-------| | ASN | 3255 (AS3255-MNT) | | Organization | UARNET-RADIOSERVICE-WIFI-20050629 | | Country | Ukraine (UA) | | City | Lviv | | RIR | RIPE | | CIDR Block | 194.44.140.0/24 | | Abuse Contact | abuse@radioservice.net.ua | \--- \## Risk Assessment **Overall Risk Score: 70/100 (High Risk)** Key risk indicators: \- DNSBL listings: 4 of 8 total lists \- Operator score: 0.1304 (Minimal) \- No services detected (firewalled/no-open-ports) \- Route stability: Unstable \- No known active campaigns or threat campaigns **Threat Indicators:** \- Not identified as Tor exit node, spam source, or known attacker \- No active threat feeds correlations \- No email authentication records (SPF/DMARC absent) \--- \## Neighborhood Context **Subnet Analysis: 194.44.140.0/24** \- Total IPs: 256 \- Active siblings: 70 \- Threat siblings: 13 (5.2% of active range) \- Abuse density: 9.22% \- Classification: Mostly clean **High-Risk Neighbors:** \- 194.44.140.0 (Risk: 55) \- 194.44.140.3 (Risk: 55) \- 194.44.140.8 (Risk: 70) The subnet exhibits moderate concentration of suspicious activity, warranting regional monitoring. \--- \## Historical Observations 13 signal observations recorded on 2026-07-24. Key signals: \- Ownership data (RIPE, ASN 3255) — Confidence: 95% \- Geolocation (UA, Lviv) — Confidence: 90% \- Operator classification (Minimal) — Confidence: 30% No evidence of persistently malicious behavior or ownership changes. \--- \## Technical Profile **Network Classification:** \- Service Purpose: Firewalled / No Services \- Open Ports: None detected \- TLS/HTTP: No active services \- Hosted Domains: 0 \- Email Reputation: Not configured **Control Plane:** \- DNSSEC: Valid \- BGP Prefix: 194.44.140.0/24 \- Route Changes (30d): 0 \- MOAS: False \- RPKI State: Not available \--- \## Recommended Actions \### Immediate Actions: 1. **Block traffic** at perimeter firewalls and WAFs 2. **Increase logging verbosity** for all traffic from 194.44.140.0/24 3. **Monitor** for emerging threat indicators from subnet neighbors \### Firewall Rules: \`\`\` iptables: iptables -A INPUT -s 194.44.140.200 -j DROP nftables: nft add rule inet filter input ip saddr 194.44.140.200 drop nginx: deny 194.44.140.200; Cloudflare WAF: Block 194.44.140.200 — IPDebrief risk score 70 AWS WAF: Addresses: 194.44.140.200/32 \`\`\` \--- \## Intelligence Notes \- No positive indicators of active exploitation (no campaigns, no known attacker flags) \- High risk score driven by DNSBL listings and neighborhood abuse density \- Subnet classification suggests opportunistic or misconfigured infrastructure \- Geographic proximity to Ukraine may correlate with regional threat activity patterns **Threat Level:** Monitor/Block **Priority:** Medium-High **Review Period:** 30 days ## Nearby addresses - 194.44.140.0 (https://ipdebrief.com/194.44.140.0) - 194.44.140.2 (https://ipdebrief.com/194.44.140.2) - 194.44.140.3 (https://ipdebrief.com/194.44.140.3) - 194.44.140.5 (https://ipdebrief.com/194.44.140.5) - 194.44.140.6 (https://ipdebrief.com/194.44.140.6) - 194.44.140.8 (https://ipdebrief.com/194.44.140.8) - 194.44.140.9 (https://ipdebrief.com/194.44.140.9) - 194.44.140.10 (https://ipdebrief.com/194.44.140.10) - 194.44.140.11 (https://ipdebrief.com/194.44.140.11) - 194.44.140.12 (https://ipdebrief.com/194.44.140.12) - 194.44.140.13 (https://ipdebrief.com/194.44.140.13) - 194.44.140.14 (https://ipdebrief.com/194.44.140.14) --- Source: IPDebrief, "194.44.140.200 IP intelligence", https://ipdebrief.com/194.44.140.200, updated 2026-10-07. Assessments are probabilistic.