95.85.238.18📋 Copy

## IP Intelligence Briefing: 95.85.238.18/32

Date: 2026-07-29

Classification: Moderate Risk

Risk Score: 50/100

---

Executive Summary

IP address 95.85.238.18 is a Czech Republic-based host with a moderate risk profile (50/100). The IP is associated with RDP services and exhibits directory enumeration activity targeting WordPress plugin paths. While not currently classified as a known attacker or persistent threat source, the IP operates within a subnet with 33% abuse density and has one active threat sibling. Recommended action: Block traffic at perimeter firewalls.

---

Technical Profile

Ownership & Registration:

• ASN: 209946
• Organization: DGTLS-MNT
• Network Name: ALTAWK-CZ
• CIDR Block: 95.85.238.0/24
• RIR: RIPE (CZ)
• Registration Status: Active

Geolocation:

• Country: Czech Republic (CZ)
• Coordinates: 49.82°N, 15.47°E
• Accuracy Radius: 200km

Network Classification:

• Role: Single-Service Host
• Not classified as cloud, CDN, VPN, proxy, Tor, hosting, or mobile
• DNSSEC: Validated
• Route Stability: Unstable (isRouteStable: false)

Services & Ports:

• Port 3389/TCP: RDP (Remote Desktop Protocol) - Open

---

Threat Indicators

Current Threat Status:

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 lists

Abuse Context:

• Abuse Confidence Score: Not available
• Threat Persistence Days: 0
• Persistently Malicious: No
• Campaign Likelihood: None

---

Observations & Activity History

Recent Activity (19 observations):

• Directory Enumeration (2026-07-29): WordPress plugin path discovery detected at `/wp-content/plugins/wp_qwosxpu/wp_qwosxpu.php` with 10 404 responses in 5 minutes
• Port Scanning (2026-07-27): Multiple port scan activity detected
• Network Scans: 30 hop traceroute via Comcast and Cogent transit networks

Temporal Analysis:

• Ownership Changes: 0
• Threat Observation Count: 0
• Threat Persistence: Low

---

Neighborhood Analysis

Subnet: 95.85.238.0/24

Abuse Density: 33.33%

Classification: Mostly Clean

Sibling IPs:

Threat Context: 1 threat sibling identified within subnet, indicating potential coordinated activity or shared infrastructure abuse.

---

Relationships

Connected Entities: 5 relationships identified

• All relationships map to "Same Network" (ALTAWK-CZ)
• No external hostname, organization, or certificate associations detected

---

Recommended Actions

Firewall Rules (Block Recommended):

---

Intelligence Notes

1. RDP Exposure: The open RDP port (3389) represents a potential lateral movement target if the IP is compromised or being used as an attack vector.

2. WordPress Targeting: Directory enumeration activity suggests automated probing for WordPress installations, consistent with vulnerability scanning or credential harvesting operations.

3. Subnet Context: The 95.85.238.0/24 subnet exhibits elevated abuse density (33.33%). Consider applying broader subnet-level controls if organizational policy permits.

4. Risk Trend: No historical persistence detected; threat activity appears episodic rather than sustained.

---

Analyst Assessment: This IP warrants blocking at perimeter defenses due to moderate risk scoring and active reconnaissance behavior. Monitor for related IPs in the 95.85.238.0/24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.