41.90.141.82📋 Copy

# IP Intelligence Briefing: 41.90.141.82/32

## Executive Summary

IP 41.90.141.82 presents as a low-risk mobile device endpoint with no active threat indicators. The address belongs to a mobile carrier infrastructure under Safaricom PLC (Kenya) but with geolocation inconsistencies pointing to London, UK. No immediate defensive action is required based on current data.

## Risk Assessment

• Overall Risk Score: 25/100 (Low Risk)
• Provider Score: 0 (No provider infrastructure detected)
• Authority Score: 0
• Stability Score: 0
• Classification: Mobile device, firewalled/no services

## Network Ownership & Registration

• ASN: 33771
• Organization: Domain Admin
• Network Block: 41.90.128.0/17 (41.90.128.0 - 41.90.255.255)
• RIR Registry: AFRINIC
• Abuse Contact: Not available

## Geolocation Intelligence

• Reported Country: GB (UK)
• Region/City: Nairobi County, London
• Mobile Carrier: Safaricom PLC (MCC 639, MNC 02)
• Inferred Location: Kenya (based on mobile carrier data)
• Note: Geographic inconsistencies detected (6,606 km distance suggests data validation issues)

## Threat Indicators

• Abuse Confidence Score: Not assigned
• Blacklist Status: Clean (0 blacklists)
• DNSBL Status: Listed on 1 of 8 threat feeds
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Campaigns: None identified

## Service Analysis

• Open Ports: None detected
• TLS Certificates: None
• HTTP Services: None
• Service Purpose: Firewalled / No Services

## Neighborhood Analysis (41.90.141.0/24)

• Subnet Abuse Density: 0 (Clean)
• Total Siblings: 7 IPs in /24
• Active Siblings: 1
• Threat Siblings: 0
• Risk Distribution:

- Low Risk: 6 IPs

- Medium Risk: 0 IPs

- High Risk: 0 IPs

Notable Neighbors:

• 41.90.141.18 (Risk: 25, Authority: 50)
• 41.90.141.219 (Risk: 25, Authority: 50)
• 41.90.141.246 (Risk: 25, Authority: 50)

## Control Plane Intelligence

• Origin ASN: 33771
• BGP Prefix: 41.90.141.0/24
• Route Stability: False (routing changes detected)
• DNSSEC: Valid
• Operator Score: 0.1304 (Minimal)
• Route Changes (30d): 0

## Historical Observation (Last 14 Observations)

Recent observations show consistent low-risk classification:

• Abuse Density: 0 across all observations
• Network Classification: Clean
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Not Persistently Malicious: Confirmed

## Recommended Actions

No firewall rules or blocking actions recommended. The IP exhibits characteristics of a legitimate mobile endpoint with no active threat indicators.

## Intelligence Notes for SOC Analysts

1. Mobile Endpoint: The IP is classified as a mobile device (Safaricom carrier), not infrastructure or hosting.

2. Low Risk Profile: Risk score of 25 with no threat indicators supports allowing traffic.

3. Geographic Discrepancy: Consider validating actual location against network logs, as geolocation data shows inconsistencies (GB vs KE).

4. Subnet Context: The broader /24 subnet shows minimal abuse density, supporting benign classification.

5. No Active Services: Firewalled with no detectable open ports or web services.

Final Assessment: Allow traffic. Monitor if this IP begins exhibiting anomalous behavior or if additional threat indicators emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.