217.26.179.25📋 Copy

# IP INTELLIGENCE BRIEFING

Subject: 217.26.179.25/32

Classification: High Risk (80/100)

Report Generated: 2026-06-26

---

## EXECUTIVE SUMMARY

IP address 217.26.179.25 is a single-service host located in Oristano, Italy, operating under ASN 209353 (Fanari Maurizio). The IP exhibits elevated risk characteristics with a risk score of 80/100 and is listed on 4 of 8 DNSBLs. The /24 neighborhood shows mixed classification with 30 threat siblings out of 72 total neighbors (41.7% threat density). Defensive action is recommended.

---

## OWNERSHIP & GEOLLOCATION

• Organization: Fanari Maurizio (trading as LABEL SISTEMI TECNOLOGICI, IT)
• ASN: 209353
• Registration: RIPE (2018-09-28)
• Geolocation: Oristano, Italy (IT)
• CIDR Block: 217.26.176.0/22
• Network Type: Single-Service Host

---

## NETWORK SERVICES

• Open Ports: TCP/80 (HTTP)
• Server Banner: lighttpd/1.4.39
• HTTP Status: 302 (Redirect)
• HTTP Version: 1.1
• TLS Certificate: None
• DNS: No PTR records, no forward resolution confirmed

---

## THREAT ASSESSMENT

Historical Context: 16 observations recorded between 2026-06-05 and 2026-06-26. Consistent lighttpd fingerprint and ASN ownership observed throughout the observation period. No persistent malicious activity flagged.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 217.26.179.0/24

• Total Neighbors: 79 IPs
• Active Siblings: 28
• Threat Siblings: 30
• Abuse Density: 0.139 (13.9%)
• Risk Distribution: 11 high-risk, 59 medium-risk, 9 low-risk

Notable High-Risk Neighbors:

• 217.26.179.19 (Risk: 80)
• 217.26.179.5 (Risk: 55)
• 217.26.179.13 (Risk: 55)
• 217.26.179.14 (Risk: 55)
• 217.26.179.21 (Risk: 55)

---

## RECOMMENDED ACTIONS

Firewall Rules

iptables:

```bash

iptables -A INPUT -s 217.26.179.25 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 217.26.179.25 drop

```

nginx:

```nginx

deny 217.26.179.25;

```

WAF Integration

Cloudflare WAF: Block IP (expression: `ip.src eq 217.26.179.25`)

AWS WAF: Add to blocked IP set (CIDR: `217.26.179.25/32`)

General Recommendation: Increase logging verbosity and review recent activity from this IP source due to elevated risk score (80/100).

---

## INTELLIGENCE NOTES

1. The IP's 302 redirect behavior may indicate proxy usage or content redirection

2. Lighttpd 1.4.39 is a relatively older web server; verify if this is a legitimate hosting service or repurposed infrastructure

3. Neighborhood risk suggests this subnet may be used for bulk hosting services

4. Four DNSBL listings correlate with the overall high-risk classification

5. No evidence of active malicious campaigns or known threat associations

---

End of Briefing

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.