134.90.238.147📋 Copy

# IP Intelligence Briefing: 134.90.238.147/32

## Executive Summary

IP address 134.90.238.147 is classified as High Risk (Risk Score: 80/100). This residential PPPOE endpoint is registered to Giuseppe Marocchio under AS48500 in Serino, Italy. The IP is listed on 6 DNS blacklists with no active services detected, indicating potential dormant malicious activity or compromised host status.

## Network Ownership & Classification

• AS Number: 48500
• Organization: GIUSEPPE MAROCCHIO
• Network Block: 134.90.238.0/24 (INC-PPPOE-10)
• Geolocation: Italy, Campania, Serino (40.86°N, 14.88°E)
• Connection Type: Residential PPPOE
• Infrastructure Classification: Firewalled / No Services

## Threat Indicators

• DNSBL Status: Listed on 6 of 8 monitored blacklists
• Operator Score: 0.2609 (Basic classification)
• Control Plane Status: Route stability flagged as unstable
• Service Exposure: No open ports detected; HTTP/HTTPS/TLS services unavailable
• Known Campaigns: None correlated

## Temporal Analysis

Signal observation history shows 15 monitoring events recorded as of 2026-07-25. The IP exhibits:

• Ownership stability: No changes recorded
• Threat persistence: 0 days
• Is not persistently classified as malicious
• Recent scanning activity detected on multiple ports

## Relationship Mapping

DNS reverse resolution confirms association with `host-134-90-238-147.as48500.net`. Network-level relationships identify the IP as part of the INC-PPPOE-10 block with no additional correlated entities beyond DNS and network associations.

## Neighborhood Assessment

Subnet analysis of 134.90.238.0/24 indicates:

• Neighboring IP count: 0
• Subnet abuse density: 0
• No threat or high-risk sibling IPs detected in immediate vicinity

## Recommended Actions

Priority: Critical

1. Firewall Blocking: Implement DROP rules across perimeter defenses

2. Logging Enhancement: Increase verbosity for traffic from this IP for forensic analysis

3. DNSBL Validation: Cross-reference against additional blacklist feeds

Firewall Rule Examples

iptables:

```bash

iptables -A INPUT -s 134.90.238.147 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 134.90.238.147 drop

```

nginx:

```nginx

deny 134.90.238.147;

```

Cloudflare WAF:

```json

{

"description": "Block 134.90.238.147 — IPDebrief risk score 80",

"action": "block",

"filter": { "expression": "ip.src eq 134.90.238.147" }

}

```

AWS WAF:

```json

{

"Addresses": ["134.90.238.147/32"],

"Description": "IPDebrief risk 80"

}

```

## Analyst Notes

The combination of elevated risk score, multiple DNSBL listings, and residential PPPOE classification warrants immediate defensive posture. While no active services are currently detected, the IP's blacklist presence suggests prior malicious activity. Monitor for any service activation or port scanning from this address. No immediate correlation to known threat campaigns or infrastructure networks identified.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.