95.141.17.3📋 Copy

INTELLIGENCE BRIEFING: IP Address 95.141.17.3/32

Classification: Moderate Risk Infrastructure

Report Date: 2026-06-24

Target: 95.141.17.3

---

EXECUTIVE SUMMARY

IP address 95.141.17.3 is a G.Network Administrators infrastructure endpoint located in the City of London, England. The address exhibits a moderate risk score of 50/100 with no active threat indicators. The IP is currently firewalled with no open services detected, though its /24 subnet shows elevated abuse density (0.6797) with 174 of 256 siblings flagged as threat sources.

OWNERSHIP & GEOGRAPHIC DATA

NETWORK CLASSIFICATION

• Infrastructure Type: Hosting/Network Infrastructure
• Service Status: Firewalled / No Services
• Cloud/Proxy/VPN: Not detected
• DNSSEC Status: Valid
• DNSBL Listings: 2 of 8 total lists

THREAT INDICATORS

• Reputation Sources: None
• Blacklist Entries: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Campaigns: None detected
• Campaign Likelihood: None

SUBNET ANALYSIS (95.141.17.0/24)

• Abuse Density: 0.6797 (High Abuse Classification)
• Active Siblings: 99 of 256 IPs
• Threat Siblings: 174 flagged as malicious
• Neighbor Risk Distribution: 100 medium-risk, 0 high/low risk
• Inherited Risk Score: 27

OBSERVATION HISTORY

Analysis of 21 historical observations reveals:

• Most recent signal: 2026-06-24 (Minimal threat level)
• Ownership stability: No changes recorded
• Threat persistence: 0 days (non-malicious)
• No escalation in threat profile over observation period

NETWORK RELATIONSHIPS

41 relationships identified, primarily:

• Same Network: UK-GNETWORK-188 (repeated associations)
• Indicates IP is part of larger G.Network infrastructure deployment

RECOMMENDED ACTIONS

Based on current risk profile and subnet context:

1. Block or Monitor: Consider blocking at perimeter due to high-abuse subnet context

2. Log Traffic: Enable logging for forensic capability if blocked

3. Monitor Subnet: Track 95.141.17.0/24 for coordinated activity patterns

4. Rate Limiting: Apply rate limits if allowing traffic through

SOC RECOMMENDATION

Priority: LOW-MEDIUM

This IP represents infrastructure with elevated neighborhood risk but no direct threat indicators. The moderate risk score (50) combined with firewalled status suggests it may be a network control or monitoring endpoint within the G.Network infrastructure. However, the high abuse density of the /24 subnet warrants defensive monitoring.

Recommended Action: Monitor or block based on organizational policy for high-abuse subnets. If allowed, implement rate limiting and logging.

---

*Report generated by IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.