41.243.25.136📋 Copy

# IP Intelligence Briefing: 41.243.25.136/32

Classification: Moderate Risk (Score: 55/100)

Reporting Period: Current data through 26 June 2026

---

## 1. Ownership and Geolocation

The IP address 41.243.25.136 is registered to Thomas Fwamini (Organization) under AS37020 (Thomas Fwamini). The address falls within the 41.243.24.0/21 CIDR block registered with AFRINIC. Geolocation data indicates the IP is associated with Kinshasa 1201, Congo DR (CD), though geovalidation shows low confidence (plausibility: false).

Control Plane Data:

• Origin ASN: 37020
• BGP Prefix: 41.243.25.0/24
• Route stability: false (route changes observed)
• DNSSEC: Valid
• DNSBL listings: 3 of 8 total lists (moderate listing presence)

---

## 2. Network Role and Services

The IP exhibits a firewalled/no services profile. No open ports were detected during scanning. The DNS PTR record resolves to 136-25-243-41.r.airtel.cd, with forward resolution confirming the domain airtel.cd.

Classification Flags:

• Not a provider, CDN, VPN, proxy, Tor exit, or hosting service
• Not mobile, residential, bogon, or anycast
• No TLS certificates or HTTP services detected

---

## 3. Threat Indicators and Reputation

The IP shows a moderate risk profile with the following threat signals:

• Abuse Confidence Score: Not quantified
• Known Attacker/Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0 (traditional blacklists)
• DNSBL Listings: 3 lists (control plane data)
• Pulse Count: 50 (threat feed activity)
• Campaign Matches: 0

Recent observations (26 June 2026) indicate threat-related signals with a pulse count of 50 across multiple threat feeds. The IP has been listed on 8 total reputation lists, with 2 currently active listings showing maximum severity of "medium."

---

## 4. Neighborhood Analysis

The /24 subnet (41.243.25.0/24) shows:

• Abuse Density: 0%
• Classification: Clean
• Threat Siblings: 0
• Active Siblings: 0

The IP appears isolated within its subnet with no neighboring threat activity.

---

## 5. Historical Trends

Analysis of 19 observations reveals:

• Observation Period: Recent activity concentrated around 26 June 2026
• Risk Trajectory: Elevated threat signals detected in most recent observations
• Threat Persistence: 0 days (no persistent malicious activity detected)
• Ownership Changes: 0 (stable ownership)

The most recent data shows elevated threat indicators with 50 pulse names associated with the IP.

---

## 6. Recommended Actions

Based on risk score 55/100, the following security actions are recommended:

Primary Recommendation: Increase logging verbosity and review recent activity from this IP due to elevated risk score (55/100).

---

## 7. Intelligence Summary

IP 41.243.25.136/32 is a moderately risky address associated with Thomas Fwamini in Kinshasa, Congo DR. The IP exhibits firewalled behavior with no active services but demonstrates elevated threat indicators in recent observations. While the immediate subnet appears clean, the IP has been listed on multiple DNSBLs and shows 50 threat pulse associations. SOC teams should monitor traffic from this address and consider blocking based on organizational risk tolerance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.