194.61.40.33📋 Copy

# IP Intelligence Briefing: 194.61.40.33/32

## Executive Summary

IP 194.61.40.33 is classified as Low Risk (risk score 25) with no active threat indicators. The address is associated with a VPN Consumer Mumbai organization under ASN 137409 (MUMBAI-IN-194-61-40-0/24). No open services detected; host appears firewalled. While listed on 1 of 8 DNS blacklists (high severity), overall subnet abuse density is zero and 19 of 20 sibling IPs show low-risk profiles.

## Technical Profile

Network Classification:

• ASN: 137409 (VPN Consumer Mumbai, India)
• CIDR Block: 194.61.40.0/24
• RIR: RIPE
• Network Role: Firewalled / No Services
• Infrastructure: Not cloud, CDN, proxy, Tor, or hosting provider

Geolocation Signals:

• Primary: Singapore (SG)
• RTT: 230–239ms (avg 235.8ms)
• Distance: 6,239.2 km from probe origin
• Geo plausible: true
• Note: Organization registration indicates Mumbai, India; geolocation shows Singapore (6,239 km discrepancy)

DNS & Control Plane:

• PTR hostnames: None
• Forward resolution: Unconfirmed
• DNSSEC: Valid
• DNSBL: Listed on 1 of 8 threat feeds (high severity listing)
• Route stability: Not stable (isRouteStable: false)

Threat Indicators:

• Known attacker: false
• Spam source: false
• Tor exit node: false
• Blacklist count: 0
• Pulsedive risk: Not applicable
• Active threat campaigns: None detected

## Observation History

Fourteen signals observed through 2026-07-28. Key findings:

• Recent AlienVault OTX listing (2 pulse matches) with country NL attribution
• DNSSEC validation confirmed
• Mixed geolocation signals (IN and SG) with low-to-moderate confidence
• No persistent malicious behavior detected (threatPersistenceDays: 0)

## Neighborhood Analysis

Subnet 194.61.40.0/24 contains 20 total addresses:

• Abuse density: 0
• Risk distribution: 19 low-risk, 0 medium/high-risk
• 4.6% of siblings show risk score 25 (4 addresses: .4, .7, .16, .47, .128, .140)
• Authority score: 50 across all neighbors

Notable Siblings (risk score 25):

• 194.61.40.4, .7, .16, .47, .128, .140

## Recommended Actions

Immediate: No specific blocking required. Monitor for service activation.

Monitoring:

• Track for service port opening
• Watch for DNSBL listing additions/removals
• Monitor for geographic signal convergence

Firewall: No rule recommendations generated (low-risk profile). If traffic must be blocked, consider:

```

iptables -A INPUT -s 194.61.40.33/32 -j DROP

```

Context: This IP shows minimal threat activity. The single DNSBL listing (high severity) warrants observation but does not indicate active malicious behavior. Subnet context is benign with no abuse density.

---

*Report generated: 2026-07-28 | Risk Score: 25/100 | Classification: Low Risk*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.