IPDebrief

94.154.43.118

IP Intelligence Dossier
Your IP: 216.73.216.5
{ } JSON πŸ”§ Full Actions API
πŸ€– Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

# IP Intelligence Briefing: 94.154.43.118/32

Date: 2026-08-10

Classification: Low Risk (Score: 35)

Jurisdiction: UA (Ukraine) / AS219502

---

## Executive Summary

IP address 94.154.43.118 is a low-risk single-service host operating on port 22 (SSH) within the 94.154.40.0/22 block (ASN 219502). The IP maintains a risk score of 35 and is not flagged as a known attacker, Tor exit node, or spam source. However, the IP appears on 2 of 8 DNSBL entries and the /24 subnet shows moderate abuse density (0.3171), with 13 threat siblings among 29 active neighbors.

---

## Network Profile

AttributeValue
**ASN**219502
**Organization**ISP5HAT-MNT
**Network**NET-94-15-40 (94.154.40.0/22)
**Country**UA (Ukraine)
**RIR**RIPE
**BGP**2914 206264 219502
**RPKI State**Valid
**Route Stability**Unstable (1 change in 30d)
**Service Type**Single-Service Host

---

## Threat Indicators

---

## Observations & History

58 total observations recorded, with recent activity from 2026-08-10 showing:

---

## Neighborhood Context

Subnet: 94.154.43.0/24

Notable high-risk neighbors include 94.154.43.230 (risk score 80), 94.154.43.36 (risk score 55), and 94.154.43.64 (risk score 55).

---

## Recommended Actions

Based on risk profile, the following rules are available for implementation:

Firewall Block:

```bash

iptables -A INPUT -s 94.154.43.118 -j DROP

nft add rule inet filter input ip saddr 94.154.43.118 drop

nginx: deny 94.154.43.118;

pfSense: 94.154.43.118/32

Cloudflare WAF: Block β€” IPDebrief risk score 35

AWS WAF: Address: 94.154.43.118/32

```

Analysis Note: The IP's risk score of 35 is moderate. Blocking is recommended due to DNSBL listings, but should be combined with other threat intelligence before enforcement. Monitor the subnet for broader malicious activity given the 13 threat-sibling count.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🌍 Geolocation

CountryπŸ‡ΊπŸ‡Έ United States
RegionUS-NJ
CityNewark
Timezoneβ€”
Latitude40.74
Longitude-74.17

🏒 Ownership & Registration

OrganizationISP5HAT-MNT
ASNAS219502
Network Nameβ€”
CIDR Block94.154.43.0/24
RIRRIPE
Countryβ€”
Abuse ContactAvailable via RDAP

🌐 DNS Intelligence

PTR RecordNo PTR
Forward ConfirmedNo β€” PTR hostname does not resolve back to this IP (weak signal)

πŸ” DNS Hygiene

Hygiene Score20% (Poor)
SPFNot configured
DMARCNot configured
FCrDNSNot verified
DNSSECValid
CAANot configured

☁️ Network Classification

InfrastructureUnknown
Service PurposeSingle-Service Host
Network TierTier 3 β€” Basic operator with some routing infrastructure
No specific classification

πŸ”Œ Services & Open Ports

PortServiceProtocolBanner
22sshtcp
Closed Ports25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned)
Serverβ€”
HTTP Titleβ€”
SSH VersionSSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16

πŸ” TLS Certificate

πŸ”’
No certificate
Issued by β€”
N/A
SANsNone
Valid Fromβ€”
Valid Untilβ€”

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

DimensionScoreSourcesObservations
threat
50%
29
routing
36%
34
services
19%
22
ownership
35%
34
reputation
32%
13
geolocation
35%
23
Overall34%1325
Coverage: 6/6 dimensions Β· Data sufficiency: sufficient
Data CoherenceConsistent (100%)
AttributionModerate (65%)
OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

πŸ“… Observation Timeline πŸ”„ Live

First Seen2026-07-23 01:42:05 UTC
Last Seen2026-08-13 06:46:14 UTC
Profile Built2026-08-13 06:47:58 UTC
Data FreshnessLive
Signal Types27
Total Observations58
πŸ” 27 signal types Β· 58 observations collected
This report is generated from 27+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.
{ } JSON API πŸ”§ Actions API πŸ“§ Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata β€” IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.