195.36.31.62📋 Copy

# Intelligence Briefing: 195.36.31.62/32

## Executive Summary

IP address 195.36.31.62 is a low-to-moderate risk infrastructure endpoint belonging to HALSERVICE-ADMIN (AS44092). The address is currently firewalled with no active services, located in Serravalle Sesia, Italy, and shows minimal threat indicators. Monitoring recommended due to elevated risk score (55/100) and DNSBL listings.

---

## Ownership & Registration

• ASN: 44092 (HALSERVICE-ADMIN)
• Network: MYWIC-NET (195.36.31.0/24)
• RIR: RIPE
• Abuse Contact: Available via RDAP

## Geolocation

• Country: Italy (IT)
• Region: Piedmont
• City: Serravalle Sesia
• Geo Confidence: Consensus established across 1 source with plausible validation

## Network Classification

• Classification: Residential/Hosting endpoint
• Services: No open ports detected (Firewalled)
• Indicators: Not a proxy, Tor, VPN, CDN, or cloud endpoint
• Bogon: No

---

## Threat Assessment

• Risk Score: 55/100 (Moderate Risk)
• Abuse Confidence: Not quantified
• Blacklist Status: Listed on 3 of 8 DNSBLs
• Known Threats: No active campaigns or known attacker indicators
• Tor Exit: No
• Residential/Hosting: Likely residential IP

---

## DNS & Hostname Resolution

• PTR Record: host-195-36-31-62.mywic.eu
• Forward Resolution: Confirmed to host-195-36-31-62.mywic.eu
• Domain: mywic.eu
• Email Authentication: SPF enabled, DMARC not configured

---

## Neighborhood Analysis

• Subnet: 195.36.31.0/24
• Abuse Density: 0 (clean)
• Threat Siblings: 0 of 1 active siblings
• Risk Distribution: No high or medium risk neighbors detected
• Subnet Classification: Clean

---

## Control Plane & Routing

• Origin ASN: 44092
• BGP Prefix: 195.36.16.0/20
• Route Stability: False
• RPKI State: Unknown
• Operator Score: 0.1304 (Minimal)

---

## Historical Observation (19 observations)

• Threat Persistence: None observed
• Ownership Changes: None detected
• Geolocation: Consistent Italian location
• Classification: Clean subnet classification maintained throughout observation period

---

## Recommended Security Actions

Monitoring

• Increase logging verbosity and review recent activity from this IP
• Monitor for service enumeration attempts

Firewall Rules (Recommended)

```bash

# iptables

iptables -A INPUT -s 195.36.31.62 -j DROP

# nftables

nft add rule inet filter input ip saddr 195.36.31.62 drop

# nginx

deny 195.36.31.62;

# pfSense

195.36.31.62/32

# Cloudflare WAF

{

"description": "Block 195.36.31.62 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 195.36.31.62"

}

}

# AWS WAF

{

"Addresses": ["195.36.31.62/32"],

"Description": "IPDebrief risk 55"

}

```

---

## Analyst Notes

This IP presents a low-to-moderate risk profile with no active malicious indicators. The moderate risk score (55) appears to be driven by DNSBL listings rather than observed threat activity. The subnet shows clean classification with no threat neighbors. Given the firewalled state and lack of services, immediate blocking may be warranted based on organizational policy, but correlation with other threat intelligence sources is recommended before implementing defensive controls.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.