41.89.227.161📋 Copy

# IP Intelligence Briefing: 41.89.227.161/32

## Executive Summary

IP 41.89.227.161 is classified as Low Risk (risk score: 15) with no active threat indicators. The address belongs to KENET Noc Team (ASN 36914) within the 41.89.227.0/24 block. While the IP shows no malicious indicators, it is DNSBL-listed on one of eight total lists and exhibits routing instability.

## Network Ownership & Classification

• ASN: 36914 (KENET Noc Team)
• Netname: 41.89.227.0 - 41.89.227.255
• RIR: afrinic
• Country: GB (geo consensus inconsistent with historical KE signals)
• Network Role: Firewalled / No Services
• Classification: Clean subnet, no active threat siblings

## Risk Assessment

The IP presents minimal threat:

• Risk Score: 15 (Low Risk)
• Threat Indicators: None detected
• Blacklist Count: 0 (despite DNSBL listing on 1 of 8 total lists)
• Reputation Sources: None
• Known Campaigns: None
• Tor Exit/Proxy/VPN: No

## Technical Observations

• Open Ports: None detected
• DNS: No PTR hostnames; forward resolution not confirmed
• Services: None active
• Control Plane: BGP prefix 41.89.227.0/24; route stability flagged as false; DNSSEC valid
• Trace Route: 18 hops; transit through Comcast and Cogent

## Neighborhood Analysis

The 41.89.227.0/24 subnet shows:

• Abuse Density: 0 (clean)
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor IP: 41.89.227.164 (risk score: 25, authority score: 50)

## Historical Context

Twelve observations recorded between 2026-07-28. Geolocation signals show inconsistency: recent probes identify Kenya (KE, Baricho, Kirinyaga County) while current profile shows GB. Operator score remains minimal (0.1304). No ownership changes or persistent threat activity observed.

## Recommended Actions

No specific firewall rules or mitigations recommended due to low risk profile. Standard network monitoring practices apply.

## Intelligence Narrative

The IP 41.89.227.161 represents a low-risk network endpoint with no active malicious behavior. While the subnet shows minimal abuse density, the single DNSBL listing and routing instability warrant routine monitoring. The neighbor IP 41.89.227.164 shows elevated authority score (50) but remains within acceptable parameters. No correlation to known threat campaigns or attacker infrastructure was identified.

Threat Level: Low

Monitoring Priority: Standard

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.