# IP Intelligence Briefing: 94.154.43.118/32
Date: 2026-08-10
Classification: Low Risk (Score: 35)
Jurisdiction: UA (Ukraine) / AS219502
---
## Executive Summary
IP address 94.154.43.118 is a low-risk single-service host operating on port 22 (SSH) within the 94.154.40.0/22 block (ASN 219502). The IP maintains a risk score of 35 and is not flagged as a known attacker, Tor exit node, or spam source. However, the IP appears on 2 of 8 DNSBL entries and the /24 subnet shows moderate abuse density (0.3171), with 13 threat siblings among 29 active neighbors.
---
## Network Profile
| Attribute | Value |
|---|---|
| **ASN** | 219502 |
| **Organization** | ISP5HAT-MNT |
| **Network** | NET-94-15-40 (94.154.40.0/22) |
| **Country** | UA (Ukraine) |
| **RIR** | RIPE |
| **BGP** | 2914 206264 219502 |
| **RPKI State** | Valid |
| **Route Stability** | Unstable (1 change in 30d) |
| **Service Type** | Single-Service Host |
---
## Threat Indicators
- DNSBL Listings: 2 positive matches (medium severity)
- Abuse Confidence: Not elevated
- Threat Feeds: No active campaign matches
- Blacklist Count: 0
- Geolocation Confidence: Plausible (500km accuracy radius)
---
## Observations & History
58 total observations recorded, with recent activity from 2026-08-10 showing:
- Traceroute signals (18 hops, reached target)
- BGP operator score: 0.4348 (Basic classification)
- DNSBL listing activity observed (max severity: high)
- Route stability concerns noted
---
## Neighborhood Context
Subnet: 94.154.43.0/24
- Total Siblings: 41
- Active Siblings: 29
- Threat Siblings: 13
- Abuse Density: 0.3171
Notable high-risk neighbors include 94.154.43.230 (risk score 80), 94.154.43.36 (risk score 55), and 94.154.43.64 (risk score 55).
---
## Recommended Actions
Based on risk profile, the following rules are available for implementation:
Firewall Block:
```bash
iptables -A INPUT -s 94.154.43.118 -j DROP
nft add rule inet filter input ip saddr 94.154.43.118 drop
nginx: deny 94.154.43.118;
pfSense: 94.154.43.118/32
Cloudflare WAF: Block β IPDebrief risk score 35
AWS WAF: Address: 94.154.43.118/32
```
Analysis Note: The IP's risk score of 35 is moderate. Blocking is recommended due to DNSBL listings, but should be combined with other threat intelligence before enforcement. Monitor the subnet for broader malicious activity given the 13 threat-sibling count.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
π’ Ownership & Registration
| Organization | ISP5HAT-MNT |
| ASN | AS219502 |
| Network Name | β |
| CIDR Block | 94.154.43.0/24 |
| RIR | RIPE |
| Country | β |
| Abuse Contact | Available via RDAP |
π DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No β PTR hostname does not resolve back to this IP (weak signal) |
π DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
βοΈ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Tier 3 β Basic operator with some routing infrastructure |
π Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | β |
| HTTP Title | β |
| SSH Version | SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 |
π TLS Certificate
| SANs | None |
| Valid From | β |
| Valid Until | β |
π― Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 50% | 2 | 9 |
| routing | 36% | 3 | 4 |
| services | 19% | 2 | 2 |
| ownership | 35% | 3 | 4 |
| reputation | 32% | 1 | 3 |
| geolocation | 35% | 2 | 3 |
| Overall | 34% | 13 | 25 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (65%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
π Observation Timeline π Live
| First Seen | 2026-07-23 01:42:05 UTC |
| Last Seen | 2026-08-13 06:46:14 UTC |
| Profile Built | 2026-08-13 06:47:58 UTC |
| Data Freshness | Live |
| Signal Types | 27 |
| Total Observations | 58 |
Full dossier details are available via our API.