95.141.17.168📋 Copy

# IP Intelligence Briefing: 95.141.17.168/32

## Executive Summary

IP 95.141.17.168 is a moderate-risk infrastructure address (Risk Score: 50) located in City of London, England. The IP is part of G.Network Administrators (ASN 202596) network infrastructure and is currently in a high-abuse subnet environment. No active services are exposed; the address is firewalled with no open ports.

## Ownership and Geolocation

• Organization: G.Network Administrators
• ASN: 202596 (RIPE)
• Location: City of London, England, GB
• BGP Prefix: 95.141.16.0/20
• Registration: RIR data available via RDAP

## Network Role and Classification

The IP is classified as infrastructure with no public services:

• No open ports detected
• Not a CDN, VPN, proxy, Tor exit, or hosting provider
• Service Purpose: "Firewalled / No Services"
• Forward DNS resolves to: 95.141.17.168.g.network

## Threat Indicators

• DNSBL Listings: Listed on 1 of 8 total DNSBLs (12.5% listing rate)
• Threat Feeds: No active threat feed indicators
• Blacklist Count: 0
• Known Campaigns: None identified
• Abuse Confidence Score: Not calculated

## Neighborhood Analysis (95.141.17.0/24)

The IP resides in a high-abuse-density subnet:

• Abuse Density: 0.7109 (High Abuse Classification)
• Total Siblings: 256
• Active Siblings: 121
• Threat Siblings: 182 (71% of active neighbors)
• Subnet Risk Inheritance: 28
• Neighbor Risk Distribution: 100% medium-risk (Risk Score: 50)

This indicates systemic abuse characteristics within the /24 subnet, suggesting potential infrastructure-level compromise or coordinated activity.

## Historical Observations

23 observations recorded with recent activity including:

• Operator Score: 0.1304 (Minimal)
• Network classification signals from June 2026
• Threat listings detected (2 high-severity listings among 8 total lists)
• Routing and reputation signals active across multiple dimensions

## Recommended Security Actions

Based on the risk profile, the following blocking rules are recommended:

iptables:

```bash

iptables -A INPUT -s 95.141.17.168 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 95.141.17.168 drop

```

nginx:

```nginx

deny 95.141.17.168;

```

pfSense:

```

95.141.17.168/32

```

Cloudflare WAF:

```json

{

"description": "Block 95.141.17.168 — IPDebrief risk score 50",

"action": "block",

"filter": {"expression": "ip.src eq 95.141.17.168"}

}

```

AWS WAF:

```json

{

"Addresses": ["95.141.17.168/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Narrative

This IP address represents infrastructure within a high-abuse network segment. While the individual IP shows no active service exposure or direct threat indicators, the surrounding /24 subnet exhibits significant abuse patterns with 182 threat-sibling IPs. The 12.5% DNSBL listing rate combined with high subnet abuse density suggests this IP may be involved in or associated with malicious infrastructure. SOC analysts should monitor for any changes in service exposure and consider broader subnet-level blocking if lateral threat movement is detected. The IP's firewalled status and lack of open services reduce immediate exploitability but warrant continued monitoring due to neighborhood risk inheritance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.