148.101.196.130📋 Copy

# IP INTELLIGENCE BRIEFING: 148.101.196.130/32

## Executive Summary

IP 148.101.196.130 is a moderate-risk residential/ISP address assigned to Compañía Dominicana de Teléfonos S. A. (AS6400) in Santiago de los Caballeros, Dominican Republic. The IP shows no active threat indicators despite moderate risk scoring, with DNSBL listings on 2 of 8 reputation feeds.

## Technical Profile

Risk Classification: Moderate Risk (Score: 50/100)

Network Owner: Compañía Dominicana de Teléfonos S. A. (AS6400)

CIDR Block: 148.101.0.0/16

Geolocation: Santiago de los Caballeros, Santiago Province, DO

DNS Resolution: 130.196.101.148.d.dyn.claro.net.do (Dynamic Claro hostname)

Service Status: Firewalled / No Services Detected

## Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 2/8 DNSBL listings
• Threat Feeds: None populated
• Campaign Correlation: None identified

DNSBL Context: Two DNSBL listings detected but no associated threat campaigns or campaign likelihood scoring.

## Geolocation Validation

Status: GEOLOCATION INVALIDATION DETECTED

Claimed Location: Santiago, DO (19.49°N, 70.74°W)

Observed RTT: 73ms average

Minimum Possible RTT: 149.1ms for claimed distance (7,454 km)

Conclusion: Geolocation data is implausible; RTT violation indicates spoofed or misreported location.

## Network Context

Subnet Analysis: 148.101.196.0/24

Abuse Density: 0%

Siblings with Activity: None

Related Networks: 148.101.0.0/16 (same provider network)

DNS Associations: Dynamic Claro.net.do hostname (130.196.101.148.d.dyn.claro.net.do)

## Observation History

Total Observations: 14 signals

Recent Activity: Last observed 2026-07-31

Threat Persistence: Not persistently malicious

Ownership Stability: No ownership changes detected

## Recommended Actions

SOC Analysis: Monitor for correlation with known threats; current profile indicates legitimate ISP infrastructure.

Firewall: No immediate blocking recommended—no active threat indicators.

DNSBL Investigation: Investigate the 2 DNSBL listings for potential reputation issues.

Geolocation: Treat claimed location as unreliable; actual operational location unknown.

## Risk Assessment

This IP represents legitimate ISP infrastructure with moderate baseline risk scoring. The absence of active threat indicators (no known campaigns, no Tor exit, no spam attribution) suggests the IP is not actively malicious. However, the DNSBL listings warrant monitoring, and the geolocation invalidation indicates potential spoofing or misattribution in infrastructure data.

Recommendation: Monitor for changes in threat indicators; no immediate blocking required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.