95.182.92.198📋 Copy

# IP INTELLIGENCE BRIEFING: 95.182.92.198/32

Date: 2024

Classification: MODERATE RISK

Risk Score: 40/100

Status: ACTIVE MONITORING

---

## EXECUTIVE SUMMARY

IP address 95.182.92.198 is a web server endpoint operated within the CLOUD-SOFTWARE network infrastructure (ASN 211273, RIPE NCC). The endpoint demonstrates moderate risk characteristics with 2 DNSBL listings and routing instability. No persistent malicious activity observed. Recommended for monitoring with selective firewall rules.

---

## NETWORK OWNERSHIP & ATTRIBUTION

---

## THREAT INTELLIGENCE

Risk Assessment: Moderate Risk (40/100)

Threat Indicators:

• Blacklist Count: 0 (direct)
• DNSBL Listings: 2/8 total lists
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Temporal Analysis:

• Threat Persistence: 0 days
• Observation Count: 1
• Persistently Malicious: No

---

## NETWORK SERVICES & FINGERPRINTING

Open Ports:

• Port 80/TCP: HTTP
• Port 443/TCP: HTTPS
• Port 22/TCP: SSH (OpenSSH_9.6p1 Ubuntu-3ubuntu13)

Server Fingerprint:

• Web Server: nginx/1.26.3
• HTTP/2: Enabled
• HSTS: Enabled (max-age=31536000)

TLS Certificate:

• Issuer: Google Trust Services LLC
• Subject: CN=tinder.com
• Location: London, GB

Application Stack:

• WordPress Engine: WP Engine
• Robots.txt: WordPress admin protection configured

---

## NEIGHBORHOOD ANALYSIS

Subnet: 95.182.92.0/24

• Abuse Density: 1
• Classification: Mostly Clean
• Inherited Risk: 2
• Threat Siblings: 1
• Active Siblings: 1

---

## CONTROL PLANE DATA

---

## OBSERVATION HISTORY

Total observations: 64

Recent Signals Include:

• HTTP/2 enabled with HSTS enforcement
• Powered by WP Engine (WordPress hosting)
• Operator score assessments: Minimal threat
• Blacklist listings observed with high/medium severity
• Route stability assessments in progress

---

## RELATIONSHIP MAPPING

Total relationships: 140

• Primary association: Same Network (CLOUD-SOFTWARE)
• Target networks: Multiple CLOUD-SOFTWARE endpoints

---

## RECOMMENDED ACTIONS

Firewall Rules (Risk-Based):

```bash

# iptables

iptables -A INPUT -s 95.182.92.198 -j DROP

# nftables

nft add rule inet filter input ip saddr 95.182.92.198 drop

# Nginx

deny 95.182.92.198;

```

Cloud Provider Actions:

• Cloudflare WAF: Block IP with risk score 40
• AWS WAF: Add 95.182.92.198/32 to block list

Monitoring Recommendations:

1. Monitor SSH port (22) for brute force attempts

2. Track DNSBL listing status

3. Observe route stability metrics

4. Monitor TLS certificate validity

---

## ASSESSMENT

The IP address presents moderate risk due to DNSBL listings and routing instability. The endpoint appears to be a legitimate cloud hosting service serving WordPress applications. The open SSH port warrants attention for potential unauthorized access attempts. No evidence of persistent malicious activity. Recommend selective blocking with ongoing monitoring.

Confidence Level: High

Last Updated: 2026-08-05

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.