195.7.40.149📋 Copy

Threat Intelligence Briefing for IP 195.7.40.149/32

Overview

• Risk Profile: Moderate Risk (Risk Score: 40)
• Ownership: Owned by Eircom Networks (ASN: AS5466), a mobile carrier in Ireland.
• Geolocation: Located in Foxford, County Clare, Ireland (53.14°N, -7.69°W).
• Network Role: Mobile carrier infrastructure (LTE/5G), no residential or cloud services.

Threat Indicators

• DNSBL Listings: Identified in 2 DNSBL feeds (2/8 total lists) with high-severity threat categories.
• Historical Activity:

- Observed in threat feeds (e.g., "Malware Distribution," "Network Scanning") with 33 pulses over 30 days.

- Linked to 2 high-severity threat campaigns (2026-06-02).

• No Active Neighbors: Subnet (195.7.40.0/24) shows no active or malicious sibling IPs.

Actionable Insights

1. Monitor Traffic: Due to moderate risk and historical threat associations, monitor traffic from this IP for unusual behavior (e.g., outbound C2 attempts, data exfiltration).

2. Block or Quarantine: Consider blocking the IP if it’s part of a larger compromised network (e.g., IE-TELECOM-980112).

3. Check Email Headers: The domain lacks SPF/DMArc records, increasing risk of email spoofing.

4. Verify BGP Stability: The IP’s BGP route has low stability (route changes in last 30 days), which could indicate network instability or misconfiguration.

Recommendations

• Add to firewall rules (e.g., iptables, Cloudflare WAF) with high-priority logging.
• Correlate with related IPs in the IE-TELECOM-980112 network for potential lateral movement.
• Re-evaluate risk if new threat indicators emerge (e.g., DNS changes, TLS certificate anomalies).

Source: IPDebrief threat intelligence platform (2026-06-17).

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.