41.198.141.91📋 Copy

## IP Intelligence Briefing: 41.198.141.91/32

Classification: Low Risk | Reputation Score: 25/100 | Location: Durban, KwaZulu-Natal, ZA (South Africa)

---

Executive Summary

IP address 41.198.141.91 is classified as low-risk with a reputation score of 25. The IP shows no active services or open ports, operating in a firewalled state. However, contextual analysis reveals elevated risk within its /24 subnet neighborhood, with one neighbor exhibiting high-risk characteristics (41.198.141.66, Risk Score: 80).

---

Network Ownership & Geolocation

• ASN: 327693
• Organization: Colin Chifamba
• Network: ORG-EPL3-AFRINIC (41.198.128.0/19)
• Country: South Africa (ZA)
• Region: KwaZulu-Natal
• City: Durban
• Registration: AFRINIC RIR

---

Threat Assessment

• Threat Indicators: None detected
• Blacklist Status: Listed on 1 of 8 threat feeds (high severity)
• Tor/VPN/Proxy: Not detected
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not applicable

---

Network Role & Services

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• DNS Resolution: No PTR records; forward resolution unavailable
• Email Auth: SPF/DMARC records absent
• Infrastructure Type: Not CDN, not cloud, not hosting

---

Control Plane Analysis

• BGP Prefix: 41.198.128.0/18
• Route Stability: Unstable (isRouteStable: false)
• DNSSEC: Valid
• Route Changes (30d): 0
• MOAS Status: Not applicable

---

Neighborhood Analysis (41.198.141.0/24)

• Abuse Density: 0.5 (moderate)
• Total Siblings: 3
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution: High (1), Medium (0), Low (2)

Notable Neighbor:

• 41.198.141.66: Risk Score 80 (High Risk) | Authority Score 50
• 41.198.141.108: Risk Score 25 (Low Risk) | Authority Score 50

---

Historical Observations

Observation Count: 14 signals recorded

• Most Recent: 2026-07-25
• Geolocation Signals: Consistent South Africa (ZA) assignment
• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: No

---

Recommended Actions

No specific firewall rules or blocking actions recommended at this time. The IP's low-risk profile (25/100) and lack of active services suggest minimal immediate threat. However, the following considerations apply:

1. Monitor Neighbor IP 41.198.141.66: High-risk (80/100) IP in same /24 subnet requires attention

2. Review Blacklist Presence: IP is listed on 1 of 8 threat feeds with high severity

3. Route Stability: Unstable routing state may indicate infrastructure changes

---

Intelligence Narrative

41.198.141.91 is a low-risk, firewalled IP address located in Durban, South Africa, under the ownership of Colin Chifamba (ORG-EPL3-AFRINIC). The address shows no active network services and no threat indicators. While the IP itself remains low-risk, the /24 subnet exhibits moderate abuse density with one neighbor (41.198.141.66) presenting high-risk characteristics. The IP's blacklist presence on 1 of 8 feeds warrants periodic monitoring but does not indicate immediate malicious activity. No firewall blocking is recommended; maintain baseline logging and monitor for any service activation or risk profile degradation.

---

Generated: SOC Intelligence Analysis

Data Source: IPDebrief Threat Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.