195.133.156.119📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 195.133.156.119/32

Classification: HIGH RISK

Report Date: Current

---

## EXECUTIVE SUMMARY

IP 195.133.156.119 is assigned to Pelephone Communications Ltd. (ASN: 16116) in Jerusalem, Israel. The address carries a risk score of 70/100 (High Risk) with elevated DNSBL listings across 4 of 8 threat intelligence feeds. No active services or open ports are detected. The IP exhibits moderate threat persistence with single threat observation events.

---

## OWNERSHIP & GEOGRAPHY

---

## RISK PROFILE

Risk Score: 70/100 (High Risk)

Threat Indicators: None identified

Blacklist Status: Listed on 4 DNSBL feeds (4/8 total)

Tor Exit Node: No

Known Attacker: No

Spam Source: No

Control Plane:

• Route Status: Unstable (isRouteStable: false)
• Route Changes (30d): 0
• BGP Prefix: 195.133.152.0/21
• RPKI State: Not evaluated

---

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 195.133.156.0/24

Abuse Density: 0.2 (20% of sibling IPs flagged)

Observation: The /24 subnet contains 5 sibling IPs. One neighbor (195.133.156.133) carries an elevated risk score of 80/100, suggesting concentrated abuse activity within this subnet.

---

## OBSERVATION HISTORY

Total Observations: 15

Threat Observation Count: 1

Persistent Malicious Activity: No

Geolocation and ownership signals have remained consistent across recent observation windows. No significant temporal shifts in risk posture detected.

---

## NETWORK SERVICES

Assessment: Address appears firewalled or dormant with no publicly accessible services.

---

## RECOMMENDED ACTIONS

Immediate Mitigation

Block traffic from 195.133.156.119/32 at perimeter security controls.

Firewall Implementation

```bash

# iptables

iptables -A INPUT -s 195.133.156.119 -j DROP

# nftables

nft add rule inet filter input ip saddr 195.133.156.119 drop

# pfSense

195.133.156.119/32

```

WAF Configuration

Cloudflare WAF:

```json

{

"description": "Block 195.133.156.119 — IPDebrief risk score 70",

"action": "block",

"filter": {

"expression": "ip.src eq 195.133.156.119"

}

}

```

AWS WAF:

```json

{

"Addresses": ["195.133.156.119/32"],

"Description": "IPDebrief risk 70"

}

```

Monitoring

Increase logging verbosity for all traffic to/from 195.133.156.0/24 subnet due to elevated abuse density (20%) and presence of high-risk neighbor (195.133.156.133).

---

## ANALYST NOTES

• The 20% abuse density in the /24 subnet warrants expanded monitoring.
• Neighbor 195.133.156.133 (Risk: 80) may require separate intelligence collection.
• No correlation to known attack campaigns or certificate-based threats detected.
• Consider blocking entire /24 subnet if operational constraints permit, given concentrated risk indicators.

---

Classification: DEFENSIVE SECURITY INTELLIGENCE

Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.