41.212.96.30📋 Copy

# INTELLIGENCE BRIEFING: 41.212.96.30/32

## Executive Summary

IP address 41.212.96.30 presents as a LOW RISK endpoint with a risk score of 25. The address is associated with WGK LIR (ASN 15399) and resolves to a single DNS hostname (41.212.96.30.wananchi.com). No active services or open ports were detected. The IP is listed on one of eight DNS blacklists but shows no persistent malicious behavior.

---

## Network Ownership & Classification

• ASN: 15399 (WGK LIR)
• CIDR Block: 41.212.96.0/24
• RIR: AFRINIC
• Geolocation: London, GB (with conflicting geo-observations from Nairobi, KE)
• Network Role: Firewalled / No Services Detected
• Ownership Stability: Stable (no ownership changes observed)

---

## Threat Indicators

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not classified
• Blacklist Status: Listed on 1 of 8 DNS blacklists
• Tor/Proxy/VPN: Negative (not identified)
• Known Campaigns: None
• Persistent Threat Activity: False

---

## Observation History Analysis

Sixteen signals were recorded between July 26, 2026. Key temporal patterns include:

• Multiple observations showed geographic inconsistencies (London vs. Nairobi)
• One observation indicated blacklist presence with high severity
• No threat persistence days recorded
• No is_persistently_malicious flags triggered

---

## Relationship Network

The IP exhibits five relationship connections:

• Network Relationships: Two entries linking to 41.212.96.0/24
• DNS Associations: Three entries resolving to 41.212.96.30.wananchi.com

No organizational or certificate relationships were identified.

---

## Neighborhood Assessment

• Subnet: 41.212.96.30/24
• Abuse Density: 0 (no abuse detected in neighborhood)
• Neighbor Count: 0 (no sibling IPs discovered)
• Risk Distribution: No high, medium, or low risk neighbors detected
• Active Threat Siblings: 0

---

## Network Services & DNS

• Open Ports: None detected
• TLS Certificate: Not detected
• DNS PTR Record: 41.212.96.30.wananchi.com
• Forward Resolution: Confirmed (1 forward hostname)
• Email Authentication: SPF present; DMARC absent
• HTTP Services: None (firewalled)

---

## Control Plane & Routing

• Route Stability: False (route changes detected)
• RPKI State: Not validated
• IRR Consistency: Not applicable
• DNSSEC: Valid
• Bogon Status: Not a bogon
• Anycast: Not detected

---

## Recommended Actions

No immediate firewall rules or security actions were generated. The IP's low risk profile and absence of active services suggest minimal threat. However, the following observations warrant continued monitoring:

• Geographic inconsistencies between profile data (GB) and historical observations (KE)
• Single DNS blacklist listing
• Route instability flag

Action: Monitor for service enumeration or service appearance. No immediate blocking recommended.

---

## Conclusion

IP 41.212.96.30/32 represents a low-risk endpoint with no active services and minimal threat indicators. The address belongs to WGK LIR's 41.212.96.0/24 block and resolves to a wananchi.com hostname. While geo-location data shows some inconsistency and one blacklist listing exists, the overall threat profile remains low. SOC teams may monitor for service enumeration but need not take immediate action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.