94.154.43.146
# IP INTELLIGENCE BRIEFING
## Target: 94.154.43.146/32
Date: Current
Classification: Low Risk / Moderate Neighborhood Concern
Risk Score: 35/100
---
EXECUTIVE SUMMARY
IP 94.154.43.146 is a single-service host with a low-risk reputation score (35). While the IP itself shows no active threat indicators, the /24 subnet exhibits mixed abuse classification with moderate density. Recent observation history indicates blacklist listings with high severity ratings.
OWNERSHIP & INFRASTRUCTURE
- ASN: 219502 (ISP5HAT-MNT)
- Registry: RIPE (Europe)
- Service Type: Single-Service Host
- Open Ports: TCP/22 (SSH - OpenSSH_8.9p1 Ubuntu)
- DNS Status: No forward resolution, no hosted domains
GEOLOCATION DATA
- Country: UA (Ukraine)
- Timezone: Europe/Kyiv
- Location Consensus: False (multiple geo sources with discordant data)
- Geographic Plausibility: Valid
THREAT ASSESSMENT
| Indicator | Status |
|---|---|
| Is Tor Exit | No |
| Is Known Attacker | No |
| Is Spam Source | No |
| Blacklist Count | 1 of 8 lists |
| Max Severity | High |
| Route Stability | Unstable (1 change/30d) |
NEIGHBORHOOD ANALYSIS
Subnet: 94.154.43.0/24
- Total Siblings: 41
- Active Siblings: 29
- Threat Siblings: 13 (32% of active IPs)
- Abuse Density: 0.3171 (moderate)
- Classification: Mixed
Notable high-risk neighbors in subnet include 94.154.43.230 (risk: 80) and 94.154.43.36 (risk: 55).
OBSERVATION HISTORY
- Total Observations: 58
- Recent Signals: Multiple blacklist listings observed with high severity
- Persistence: Single threat observation recorded
- Route Changes: 1 within 30-day window
RECOMMENDED ACTIONS
Immediate: Monitor but do not block without additional context. Risk score is low-to-moderate.
Firewall Rules (if blocking required):
- `iptables -A INPUT -s 94.154.43.146 -j DROP`
- `nft add rule inet filter input ip saddr 94.154.43.146 drop`
- Cloudflare/AWS WAF: Block 94.154.43.146/32
Contextual Notes:
- The /24 subnet contains 13 known threat IPs; consider evaluating 94.154.43.230 for higher priority
- Route instability suggests potential infrastructure changes or hijacking risk
- Geographic data shows consensus issues requiring validation
CONCLUSION
IP 94.154.43.146 presents low-to-moderate risk. No immediate threat indicators present, but neighborhood context and recent blacklist listings warrant monitoring. Consider subnet-level analysis if observing traffic patterns from this /24 range.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | ISP5HAT-MNT |
| ASN | AS219502 |
| Network Name | — |
| CIDR Block | 94.154.43.0/24 |
| RIR | RIPE |
| Country | — |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
| SSH Version | SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16 |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 45% | 2 | 5 |
| routing | 30% | 3 | 4 |
| services | 19% | 2 | 2 |
| ownership | 40% | 3 | 6 |
| reputation | 31% | 1 | 3 |
| geolocation | 35% | 2 | 3 |
| Overall | 33% | 13 | 23 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (65%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-23 01:42:05 UTC |
| Last Seen | 2026-08-13 06:46:14 UTC |
| Profile Built | 2026-08-13 10:58:27 UTC |
| Data Freshness | Live |
| Signal Types | 27 |
| Total Observations | 58 |
Full dossier details are available via our API.