95.141.17.118📋 Copy

# INTELLIGENCE BRIEFING: 95.141.17.118/32

Date: 2026-06-04

Classification: Moderate Risk

Status: Actionable Intelligence

---

## Executive Summary

IP address 95.141.17.118 is classified as Moderate Risk (Risk Score: 50) with no active threat indicators. The IP operates under G.Network Administrators (ASN 202596) in the City of London, England. While the IP itself shows no direct malicious activity, it resides within a high-abuse density subnet (95.141.17.0/24) with 178 threat siblings out of 256 total addresses.

---

## Infrastructure Profile

---

## Network Characteristics

• Service Status: Firewalled / No Services (no open ports detected)
• DNS Resolution: 95.141.17.118.g.network (forward confirmed: No)
• Reverse DNS: 95.141.17.118.g.network
• Email Authentication: SPF and DMARC configured
• Route Stability: False (routing changes detected)
• DNSSEC: Valid

---

## Threat Assessment

Direct Threat Indicators: None detected

• Not a Tor exit node
• Not a known attacker
• Not a spam source
• No active blacklist entries
• No known campaign associations

Subnet Context (High Risk):

• Subnet: 95.141.17.0/24
• Abuse Density: 0.6953 (High)
• Threat Siblings: 178 out of 256 addresses
• Inherited Risk Score: 27

Historical Observations: 18 signals recorded, with operator score of 0.1304 (Minimal). No persistent malicious behavior observed.

---

## Neighborhood Analysis

The /24 subnet shows elevated abuse activity:

• 97 medium-risk neighbors
• 3 low-risk neighbors
• 0 high-risk neighbors (excluding the target)
• 109 active siblings identified

This environment-based risk suggests the subnet may be used for legitimate infrastructure with some abuse activity, rather than a dedicated malicious network.

---

## Recommended Actions

Based on the risk profile, the following blocking rules are recommended:

Firewall Rules:

```bash

iptables -A INPUT -s 95.141.17.118 -j DROP

nft add rule inet filter input ip saddr 95.141.17.118 drop

```

Application-Level:

```nginx

deny 95.141.17.118;

```

Cloud WAF Rules:

• Cloudflare WAF: Block with expression `ip.src eq 95.141.17.118`
• AWS WAF: Add 95.141.17.118/32 to deny list

---

## Intelligence Narrative

IP 95.141.17.118 presents a moderate-risk profile with no direct malicious indicators. The IP is properly registered under G.Network Administrators with valid DNSSEC and email authentication controls. However, the subnet (95.141.17.0/24) demonstrates high abuse density with 69.5% abuse classification and 178 identified threat siblings, suggesting coordinated or opportunistic abuse activity within the neighborhood.

The route stability flag indicates recent BGP changes, which may warrant monitoring for potential infrastructure shifts. While the IP itself shows no active threat behavior, the subnet environment suggests implementing defensive filtering is prudent for risk mitigation.

---

Sources: IPDebrief Intelligence Platform

Confidence Level: High (based on comprehensive profile data)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.