36.95.221.140📋 Copy

# INTELLIGENCE BRIEFING: IP 36.95.221.140

Classification: MODERATE RISK

Date: 2026-06-26

Status: ACTIVE MONITORING

---

## EXECUTIVE SUMMARY

IP address 36.95.221.140 presents a moderate risk profile (Score: 50) with Indonesian infrastructure ownership. The address is currently firewalled with no active services, but shows intermittent DNS blacklist presence (2 of 8 lists). No active threat campaigns or known attacker indicators detected.

---

## OWNERSHIP AND INFRASTRUCTURE

Network Classification: Provider infrastructure with no residential/mobile classification. Address is not bogon, proxy, or CDN.

---

## THREAT INDICATORS

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0 (but DNSBL listed on 2 of 8 feeds)
• Threat Feeds: None active
• Campaign Associations: None
• Abuse Confidence: Not calculated

Service Status: Firewalled with no open ports detected. No TLS certificates, HTTP banners, or email authentication records (SPF/DMARC) observed.

---

## CONTROL PLANE ANALYSIS

• BGP Prefix: 36.95.221.0/24
• Route Stability: Unstable
• RPKI State: Not validated
• DNSSEC: Valid
• DNSBL Listed: 2 of 8 total lists
• Operator Score: 0.1304 (Minimal)
• IRR Consistency: Not evaluated

---

## NEIGHBORHOOD ANALYSIS

Subnet: 36.95.221.140/24

• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1
• Abuse Density: 1 (low)
• Classification: mostly_clean
• Inherited Risk: 2 (low)

---

## OBSERVATION HISTORY (16 signals)

Recent signal timeline indicates intermittent listing activity:

• 2026-06-26: High-severity listing detected (DNSBL)
• 2026-06-17: Operator score recorded at 0.1304 (Minimal)
• 2026-06-06: Subnet abuse density classified as mostly_clean
• Earlier signals: No persistent malicious behavior observed

Persistence Assessment: Not persistently malicious (0 threat observation persistence days).

---

## RELATIONSHIP GRAPH

All 16 relationship links point to TELKOMNET network infrastructure. No external entity correlations (subnets, hostnames, organizations, certificates) beyond the owning network.

---

## RECOMMENDED ACTIONS

Risk-Based Blocking Recommended:

---

## ANALYST NOTES

1. The IP is part of Indonesian telecom infrastructure (TELKOMNET) and currently serves no active web services.

2. DNSBL presence on 2 of 8 lists warrants monitoring but does not indicate confirmed malicious activity.

3. Route instability (isRouteStable: false) may indicate transient infrastructure changes.

4. Low inherited risk in neighborhood suggests this IP is not part of a coordinated abuse cluster.

5. Recommendation: Implement blocking rules while continuing to monitor for service activation or new threat indicators.

---

*Intelligence generated by IPDebrief. Recommendations should be validated with local security context before deployment.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.