41.204.32.189📋 Copy

# IP Intelligence Briefing: 41.204.32.189/32

Date: 2026-07-29

Classification: Low Risk / Clean

Status: Active Monitoring

---

## Executive Summary

IP address 41.204.32.189 is a residential static IP with a low risk profile (score: 25). The address is geolocated to Accra, Ghana under registrant Michael Komla Nfodzo (ASN 29614, Afrinic), with DNS records pointing to a Ghanaian domain (.gh). The IP shows minimal threat activity and no active service exposure.

---

## Technical Profile

---

## Threat Indicators

• Abuse Confidence: Not elevated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 1 (high severity listing)
• Threat Feeds: None detected
• Campaign Correlation: No active campaigns

Note: One DNSBL listing detected with high severity classification. Requires validation.

---

## Network Neighborhood

The /24 subnet shows zero abuse density with no neighboring threats detected.

---

## Relationship Analysis

• Same Network: 41.204.32.0 - 41.204.47.255
• DNS Associations:

- 41-204-32-189-adsl-static.4u.com.gh (appears twice in relationship graph)

No organizational or certificate-based relationships detected beyond the local network scope.

---

## Observation History (16 Observations)

The IP has been monitored since at least 2026-07-29. Key signals include:

• Ownership Changes: 0 (stable registration)
• Threat Persistence: 0 days (no persistent malicious activity)
• DNSBL Listings: Listed on 1 of 8 total lists (high severity)
• Geolocation: Mixed signals — Ghana (Accra) and US (New York) detected across probes. This suggests potential geolocation spoofing or multi-CDN routing.
• Stability: Route stability flagged as false; ownership average days unavailable

---

## Network Behavior

• Traceroute: 30 hops with 14 timed out
• Transit Network: Comcast
• RTT: Last hop 184.4ms
• HTTP Status: No active services responding
• TLS/Certificates: None

---

## Recommended Actions

1. Monitor DNSBL Listing: Investigate the high-severity blacklist entry to determine cause and remediation path

2. Verify Geolocation: Resolve discrepancy between Ghana (.gh DNS) and US geolocation reports

3. Allow Traffic: No blocking required based on current low-risk profile

4. Continual Observation: Maintain monitoring for any emergence of threat indicators

---

## Assessment

This IP represents a standard residential static connection with no active malicious behavior. The single DNSBL listing warrants review but does not indicate immediate threat. The geolocation discrepancy between DNS records and geolocation probes should be investigated to ensure accurate threat correlation. The subnet remains clean with no associated threats.

Classification: LOW RISK — No action required at this time.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.